Method, System, and Computer Program Product for Detecting Fraudulent Interactions

ABSTRACT

A method for detecting fraudulent interactions may include receiving interaction data, including a first plurality of interactions with (first) fraud labels and a second plurality of interactions (without fraud labels). Second fraud label data for each of the second plurality of interactions may be generated with a first neural network (e.g., classifying whether each interaction is fraudulent or not). Generated interaction data and generated fraud label data may be generated with a second neural network. Discrimination data for each of the second plurality of interactions and generated interactions may be generated with a third neural network (e.g., classifying whether the respective interaction is real or not). Error data may be determined based on the discrimination data (e.g., whether the respective interaction is correctly classified). At least one of the neural networks may be trained based on the error data. A system and computer program product are also disclosed.

BACKGROUND 1. Field

This disclosed subject matter relates generally to methods, systems, andproducts for detecting fraudulent interactions and, in some particularembodiments, to a method, system, and computer program product fordetecting fraudulent interactions using multiple neural networks.

2. Technical Considerations

Certain institutions (e.g., transaction service providers, issuers,acquirers, merchants, and/or the like) may process a high volume oftransactions (e.g., authorization requests and/or authorizationresponses) every day. For example, a transaction service provider systemin an electronic payment processing network may process thousands oftransactions per second. Some transactions may be fraudulent, but it maybe difficult to determine which transactions are potentially and/oractually fraudulent. For example, certain institutions may rely onmanual review of transactions to identify fraud. Additionally oralternatively, certain institutions (e.g., computer systems thereof) mayemploy various predefined rules or score functions for assessing thelikelihood that a transaction is fraudulent. For example, a transactionflagged based on the predefined rules/scoring may be forwarded to anindividual for manual review. Additionally or alternatively, aftermanual review of the transactions, labels (e.g., fraud, not fraud,and/or the like) may be assigned to the reviewed transactions, and aclassifier (e.g., neural network and/or the like) may be trained todetect fraud in other transactions after being trained with the labeledtransactions.

However, manual review may be burdensome, time consuming, and/orexpensive in terms of manual efforts. As such, only a small portion ofall transactions may be manually reviewed. Moreover, as only a smallportion of all transactions are reviewed and labeled, a large portion ofall transactions may remain unlabeled. Such unlabeled transactions maybe unsuitable (e.g., not useful and/or the like) for machine learning(e.g., supervised learning in classifiers such as neural networks and/orthe like). Further, predefined rules may be designed to detectfraudulent transactions under certain known circumstances (e.g., knownpatterns of fraudsters and/or the like), but such rules may beunsuitable for detecting or adjusting to new patterns employed byfraudsters to overcome such rules (e.g., it may be difficult to adjustsuch rules, designers of such rules may remain unaware of such newpatterns, and/or the like). In addition, such classifiers (e.g., neuralnetworks, machine learning models, and/or the like) trained on the smallportion of transactions for which labels are provided may lacksufficient data for training, and therefore, such classifiers may beunsuitable for (e.g., unable to, inadequate for, and/or the like)detecting complex patterns, new patterns, and/or the like.

A generative adversarial network (GAN) may be used to create highquality fake data meant to resemble real data. Certain GANs may employtwo machine learning models (e.g., neural networks and/or the like),which may be referred to a generator and a discriminator. For example,the generator may be a neural network that transforms an input (e.g., avector of random values (e.g., a random noise vector) and/or the like)into fake data. Additionally, the discriminator may be a neural networkthat receives the fake data from the generator (and/or some real data)as an input and classifies the input as real or fake (e.g., determines aprobability that the input is real or fake). The discriminator'sclassification may be correct or incorrect (e.g., an error and/or thelike). Information regarding errors (e.g., error for each input, errorrate over multiple inputs, and/or the like) may be used for training ofthe generator and/or the discriminator. For example, the generator maybe trained to attempt to increase the errors (e.g., increase thelikelihood for an error for each input, increase the error rate, and/orthe like) and/or the discriminator may be trained to decrease the errors(e.g., decrease the likelihood for an error for each input, decrease theerror rate, and/or the like). Over time (e.g., after a number oftraining iterations and/or the like), the generator may improve atgenerating fake data and/or the discriminator may improve at classifyinginputs as real or fake.

However, GANs may be insufficient (e.g., unable, inadequate, and/or thelike) to classify what type of data the real data is (e.g., to providelabels for the real data). If the real data includes images, each imagemay be converted into a vector representation for inputting into thediscriminator, and the discriminator may be able to classify that vectorrepresentation as real or fake. Yet, the discriminator may beinsufficient (e.g., unable, inadequate, and/or the like) to classifywhat is depicted in the image (or even that the vector representation isan image as opposed to some other type of data). Similarly, if the realdata is transaction data, a fraudulent transaction may be a realtransaction, and the discriminator may be able to classify thetransaction data thereof as real or fake. Yet, the discriminator may beinsufficient (e.g., unable, inadequate, and/or the like) to classifywhether the transaction is fraudulent.

SUMMARY

Accordingly, it is an object of the presently disclosed subject matterto provide methods, systems, and computer program products for detectingfraudulent interactions, e.g., using multiple neural networks.

According to non-limiting embodiments, provided is a method fordetecting fraudulent interactions. In some non-limiting embodiments, amethod for detecting fraudulent interactions may include receivinginteraction data associated with a plurality of interactions. Theplurality of interactions may include a first plurality of interactionsand a second plurality of interactions different than the firstplurality of interactions. First fraud label data for each respectiveinteraction of the first plurality of interactions may be received. Thefirst fraud label data may be associated with whether the respectiveinteraction of the first plurality of interactions is fraudulent. Secondfraud label data for each interaction of the second plurality ofinteractions may be generated with a first neural network based on theinteraction data of the second plurality of interactions. The secondfraud label data for each respective interaction of the second pluralityof interactions may be associated with whether the first neural networkclassifies the respective interaction as fraudulent. Generatedinteraction data associated with a plurality of generated interactionsand generated fraud label data for each generated interaction of theplurality of generated interactions may be generated with a secondneural network. Discrimination data for each interaction of the secondplurality of interactions and each generated interaction of theplurality of generated interactions may be generated with a third neuralnetwork based on the interaction data for each interaction of the secondplurality of interactions, the second fraud label data, the generatedinteraction data, and the generated fraud label data. The discriminationdata for each interaction or generated interaction may be associatedwith whether the third neural network classifies the respectiveinteraction or generated interaction as real or generated. First errordata for each respective interaction of the second plurality ofinteractions may be determined based on the discrimination data. Thefirst error data for each respective interaction may be associated withwhether the discrimination data for the respective interaction correctlyclassifies the respective interaction as real. The first neural networkmay be trained based on the first error data associated with theinteractions of the second plurality of interactions.

In some non-limiting embodiments, the first neural network may betrained (e.g., initially trained, further trained, and/or the like)based on the interaction data of the first plurality of transactions andthe first fraud label data. Additionally or alternatively, the firstneural network may be trained (e.g., further trained and/or the like)based on the generated interaction data and the generated fraud labeldata.

In some non-limiting embodiments, second error data for each generatedinteraction of the generated interaction data may be determined based onthe discrimination data. Additionally or alternatively, the second errordata for each respective generated interaction may be associated withwhether the discrimination data for the respective generated interactioncorrectly classifies the respective generated interaction as generated.Additionally or alternatively, the second neural network may be trainedbased on the second error data associated with the generatedinteractions of the generated interaction data.

In some non-limiting embodiments, the third neural network may betrained based on at least one of the first error data, the second errordata, the interaction data of the first plurality of transactions, thefirst fraud label data, or any combination thereof.

In some non-limiting embodiments, at least one random vector may begenerated. Generating the generated interaction data and the generatedfraud label data may include generating the generated interaction dataassociated with the plurality of generated interactions and thegenerated fraud label data for each generated interaction of theplurality of generated interactions with the second neural network basedon the at least one random vector.

In some non-limiting embodiments, the first neural network may include aclassifier. Additionally or alternatively, the second neural network mayinclude a generator. Additionally or alternatively, the third neuralnetwork may include a discriminator.

In some non-limiting embodiments, the interaction data may have a firstnumber of features and the generated interaction data may have the(same) first number of features. Additionally or alternatively, the atleast one random vector may have a second number of features less thanthe first number of features. Additionally or alternatively, thegenerator may include an input for each feature of the second number offeatures and an output for each feature of the first number of features.Additionally or alternatively, the classifier may include an input foreach feature of the first number of features, and the classifier mayinclude a single output or two outputs. Additionally or alternatively,the discriminator may include an input for each feature of the firstnumber of features, and the discriminator may include a single output ortwo outputs.

In some non-limiting embodiments, the first neural network may includeat least one of a first multilayer perceptron (MLP), a first fullyconnected neural network, a first deep neural network, a firstconvolutional neural network, any combination thereof, and/or the like.Additionally or alternatively, the second neural network may include atleast one of a second MLP, a second fully connected neural network, asecond deep neural network, a second convolutional neural network, anycombination thereof, and/or the like. Additionally or alternatively, thethird neural network may include at least one of a third MLP, a thirdfully connected neural network, a third deep neural network, a thirdconvolutional neural network, any combination thereof, and/or the like.

In some non-limiting embodiments, further interaction data associatedwith at least one further interaction may be received. Additionally oralternatively, further fraud label data for the at least one furtherinteraction may be generated with the first neural network based on thefurther interaction data. Additionally or alternatively, the furtherfraud label data for the at least one further interaction may beassociated with whether the first neural network classifies the at leastone further interaction as fraudulent.

According to non-limiting embodiments, provided is a system fordetecting fraudulent interactions. In some non-limiting embodiments, thesystem for detecting fraudulent interactions may include at least oneprocessor and at least one non-transitory computer-readable mediumcomprising instructions to direct the at least one processor to receiveinteraction data associated with a plurality of interactions. Theplurality of interactions may include a first plurality of interactionsand a second plurality of interactions different than the firstplurality of interactions. First fraud label data for each respectiveinteraction of the first plurality of interactions may be received. Thefirst fraud label data may be associated with whether the respectiveinteraction of the first plurality of interactions is fraudulent. Secondfraud label data for each interaction of the second plurality ofinteractions may be generated with a first neural network based on theinteraction data of the second plurality of interactions. The secondfraud label data for each respective interaction of the second pluralityof interactions may be associated with whether the first neural networkclassifies the respective interaction as fraudulent. Generatedinteraction data associated with a plurality of generated interactionsand generated fraud label data for each generated interaction of theplurality of generated interactions may be generated with a secondneural network. Discrimination data for each interaction of the secondplurality of interactions and each generated interaction of theplurality of generated interactions may be generated with a third neuralnetwork based on the interaction data for each interaction of the secondplurality of interactions, the second fraud label data, the generatedinteraction data, and the generated fraud label data. The discriminationdata for each interaction or generated interaction may be associatedwith whether the third neural network classifies the respectiveinteraction or generated interaction as real or generated. First errordata for each respective interaction of the second plurality ofinteractions may be determined based on the discrimination data. Thefirst error data for each respective interaction may be associated withwhether the discrimination data for the respective interaction correctlyclassifies the respective interaction as real. The first neural networkmay be trained based on the first error data associated with theinteractions of the second plurality of interactions.

In some non-limiting embodiments, the first neural network may betrained (e.g., initially trained, further trained, and/or the like)based on the interaction data of the first plurality of transactions andthe first fraud label data. Additionally or alternatively, the firstneural network may be trained (e.g., further trained and/or the like)based on the generated interaction data and the generated fraud labeldata.

In some non-limiting embodiments, second error data for each generatedinteraction of the generated interaction data may be determined based onthe discrimination data. Additionally or alternatively, the second errordata for each respective generated interaction may be associated withwhether the discrimination data for the respective generated interactioncorrectly classifies the respective generated interaction as generated.Additionally or alternatively, the second neural network may be trainedbased on the second error data associated with the generatedinteractions of the generated interaction data.

In some non-limiting embodiments, the third neural network may betrained based on at least one of the first error data, the second errordata, the interaction data of the first plurality of transactions, thefirst fraud label data, or any combination thereof.

In some non-limiting embodiments, at least one random vector may begenerated. Generating the generated interaction data and the generatedfraud label data may include generating the generated interaction dataassociated with the plurality of generated interactions and thegenerated fraud label data for each generated interaction of theplurality of generated interactions with the second neural network basedon the at least one random vector.

In some non-limiting embodiments, the first neural network may include aclassifier. Additionally or alternatively, the second neural network mayinclude a generator. Additionally or alternatively, the third neuralnetwork may include a discriminator.

In some non-limiting embodiments, the interaction data may have a firstnumber of features and the generated interaction data may have the(same) first number of features. Additionally or alternatively, the atleast one random vector may have a second number of features less thanthe first number of features. Additionally or alternatively, thegenerator may include an input for each feature of the second number offeatures and an output for each feature of the first number of features.Additionally or alternatively, the classifier may include an input foreach feature of the first number of features, and the classifier mayinclude a single output or two outputs. Additionally or alternatively,the discriminator may include an input for each feature of the firstnumber of features, and the discriminator may include a single output ortwo outputs.

In some non-limiting embodiments, the first neural network may includeat least one of a first multilayer perceptron (MLP), a first fullyconnected neural network, a first deep neural network, a firstconvolutional neural network, any combination thereof, and/or the like.Additionally or alternatively, the second neural network may include atleast one of a second MLP, a second fully connected neural network, asecond deep neural network, a second convolutional neural network, anycombination thereof, and/or the like. Additionally or alternatively, thethird neural network may include at least one of a third MLP, a thirdfully connected neural network, a third deep neural network, a thirdconvolutional neural network, any combination thereof, and/or the like.

In some non-limiting embodiments, further interaction data associatedwith at least one further interaction may be received. Additionally oralternatively, further fraud label data for the at least one furtherinteraction may be generated with the first neural network based on thefurther interaction data. Additionally or alternatively, the furtherfraud label data for the at least one further interaction may beassociated with whether the first neural network classifies the at leastone further interaction as fraudulent.

According to non-limiting embodiments, provided is a computer programproduct for detecting fraudulent interactions. The computer programproduct may include at least one non-transitory computer-readable mediumincluding one or more instructions that, when executed by at least oneprocessor, cause the at least one processor to receive interaction dataassociated with a plurality of interactions. The plurality ofinteractions may include a first plurality of interactions and a secondplurality of interactions different than the first plurality ofinteractions. First fraud label data for each respective interaction ofthe first plurality of interactions may be received. The first fraudlabel data may be associated with whether the respective interaction ofthe first plurality of interactions is fraudulent. Second fraud labeldata for each interaction of the second plurality of interactions may begenerated with a first neural network based on the interaction data ofthe second plurality of interactions. The second fraud label data foreach respective interaction of the second plurality of interactions maybe associated with whether the first neural network classifies therespective interaction as fraudulent. Generated interaction dataassociated with a plurality of generated interactions and generatedfraud label data for each generated interaction of the plurality ofgenerated interactions may be generated with a second neural network.Discrimination data for each interaction of the second plurality ofinteractions and each generated interaction of the plurality ofgenerated interactions may be generated with a third neural networkbased on the interaction data for each interaction of the secondplurality of interactions, the second fraud label data, the generatedinteraction data, and the generated fraud label data. The discriminationdata for each interaction or generated interaction may be associatedwith whether the third neural network classifies the respectiveinteraction or generated interaction as real or generated. First errordata for each respective interaction of the second plurality ofinteractions may be determined based on the discrimination data. Thefirst error data for each respective interaction may be associated withwhether the discrimination data for the respective interaction correctlyclassifies the respective interaction as real. The first neural networkmay be trained based on the first error data associated with theinteractions of the second plurality of interactions.

In some non-limiting embodiments, the first neural network may betrained (e.g., initially trained, further trained, and/or the like)based on the interaction data of the first plurality of transactions andthe first fraud label data. Additionally or alternatively, the firstneural network may be trained (e.g., further trained and/or the like)based on the generated interaction data and the generated fraud labeldata.

In some non-limiting embodiments, second error data for each generatedinteraction of the generated interaction data may be determined based onthe discrimination data. Additionally or alternatively, the second errordata for each respective generated interaction may be associated withwhether the discrimination data for the respective generated interactioncorrectly classifies the respective generated interaction as generated.Additionally or alternatively, the second neural network may be trainedbased on the second error data associated with the generatedinteractions of the generated interaction data.

In some non-limiting embodiments, the third neural network may betrained based on at least one of the first error data, the second errordata, the interaction data of the first plurality of transactions, thefirst fraud label data, or any combination thereof.

In some non-limiting embodiments, at least one random vector may begenerated. Generating the generated interaction data and the generatedfraud label data may include generating the generated interaction dataassociated with the plurality of generated interactions and thegenerated fraud label data for each generated interaction of theplurality of generated interactions with the second neural network basedon the at least one random vector.

In some non-limiting embodiments, the first neural network may include aclassifier. Additionally or alternatively, the second neural network mayinclude a generator. Additionally or alternatively, the third neuralnetwork may include a discriminator.

In some non-limiting embodiments, the interaction data may have a firstnumber of features and the generated interaction data may have the(same) first number of features. Additionally or alternatively, the atleast one random vector may have a second number of features less thanthe first number of features. Additionally or alternatively, thegenerator may include an input for each feature of the second number offeatures and an output for each feature of the first number of features.Additionally or alternatively, the classifier may include an input foreach feature of the first number of features, and the classifier mayinclude a single output or two outputs. Additionally or alternatively,the discriminator may include an input for each feature of the firstnumber of features, and the discriminator may include a single output ortwo outputs.

In some non-limiting embodiments, the first neural network may includeat least one of a first multilayer perceptron (MLP), a first fullyconnected neural network, a first deep neural network, a firstconvolutional neural network, any combination thereof, and/or the like.Additionally or alternatively, the second neural network may include atleast one of a second MLP, a second fully connected neural network, asecond deep neural network, a second convolutional neural network, anycombination thereof, and/or the like. Additionally or alternatively, thethird neural network may include at least one of a third MLP, a thirdfully connected neural network, a third deep neural network, a thirdconvolutional neural network, any combination thereof, and/or the like.

In some non-limiting embodiments, further interaction data associatedwith at least one further interaction may be received. Additionally oralternatively, further fraud label data for the at least one furtherinteraction may be generated with the first neural network based on thefurther interaction data. Additionally or alternatively, the furtherfraud label data for the at least one further interaction may beassociated with whether the first neural network classifies the at leastone further interaction as fraudulent.

Further embodiments are set forth in the following numbered clauses:

Clause 1: A method for detecting fraudulent interactions, comprising:receiving, with at least one processor, interaction data associated witha plurality of interactions, the plurality of interactions comprising afirst plurality of interactions and a second plurality of interactionsdifferent than the first plurality of interactions; receiving, with atleast one processor, first fraud label data for each respectiveinteraction of the first plurality of interactions, the first fraudlabel data associated with whether the respective interaction of thefirst plurality of interactions is fraudulent; generating, with at leastone processor, second fraud label data for each interaction of thesecond plurality of interactions with a first neural network based onthe interaction data of the second plurality of interactions, the secondfraud label data for each respective interaction of the second pluralityof interactions associated with whether the first neural networkclassifies the respective interaction as fraudulent; generating, with atleast one processor, generated interaction data associated with aplurality of generated interactions and generated fraud label data foreach generated interaction of the plurality of generated interactionswith a second neural network; generating, with at least one processor,discrimination data for each interaction of the second plurality ofinteractions and each generated interaction of the plurality ofgenerated interactions with a third neural network based on theinteraction data for each interaction of the second plurality ofinteractions, the second fraud label data, the generated interactiondata, and the generated fraud label data, the discrimination data foreach interaction or generated interaction associated with whether thethird neural network classifies the respective interaction or generatedinteraction as real or generated; determining, with at least oneprocessor, first error data for each respective interaction of thesecond plurality of interactions based on the discrimination data, thefirst error data for each respective interaction associated with whetherthe discrimination data for the respective interaction correctlyclassifies the respective interaction as real; and training, with atleast one processor, the first neural network based on the first errordata associated with the interactions of the second plurality ofinteractions.

Clause 2: The method of clause 1, further comprising training, with atleast one processor, the first neural network based on the interactiondata of the first plurality of transactions and the first fraud labeldata.

Clause 3: The method of any preceding clause, further comprisingtraining, with at least one processor, the first neural network based onthe generated interaction data and the generated fraud label data.

Clause 4: The method of any preceding clause, further comprising:determining, with at least one processor, second error data for eachgenerated interaction of the generated interaction data based on thediscrimination data, the second error data for each respective generatedinteraction associated with whether the discrimination data for therespective generated interaction correctly classifies the respectivegenerated interaction as generated; and training, with at least oneprocessor, the second neural network based on the second error dataassociated with the generated interactions of the generated interactiondata.

Clause 5: The method of any preceding clause, further comprising:training, with at least one processor, the third neural network based onat least one of the first error data, the second error data, theinteraction data of the first plurality of transactions, the first fraudlabel data, or any combination thereof.

Clause 6: The method of any preceding clause, further comprisinggenerating, with at least one processor, at least one random vector,wherein generating the generated interaction data and the generatedfraud label data comprises generating, with at least one processor, thegenerated interaction data associated with the plurality of generatedinteractions and the generated fraud label data for each generatedinteraction of the plurality of generated interactions with the secondneural network based on the at least one random vector.

Clause 7: The method of any preceding clause, wherein the first neuralnetwork comprises a classifier, the second neural network comprises agenerator, and the third neural network comprises a discriminator.

Clause 8: The method of any preceding clause, wherein the interactiondata comprises a first number of features and the generated interactiondata comprises the first number of features, wherein at least one randomvector comprises a second number of features less than the first numberof features, wherein the generator comprises an input for each featureof the second number of features and an output for each feature of thefirst number of features, wherein the classifier comprises an input foreach feature of the first number of features and a single output, andwherein the discriminator comprises an input for each feature of thefirst number of features and a single output.

Clause 9: The method of any preceding clause, wherein the first neuralnetwork comprises at least one of a first multilayer perceptron (MLP), afirst fully connected neural network, a first deep neural network, afirst convolutional neural network, or any combination thereof, whereinthe second neural network comprises at least one of a second MLP, asecond fully connected neural network, a second deep neural network, asecond convolutional neural network, or any combination thereof, andwherein the third neural network comprises at least one of a third MLP,a third fully connected neural network, a third deep neural network, athird convolutional neural network, or any combination thereof.

Clause 10: The method of any preceding clause, further comprising:receiving, with at least one processor, further interaction dataassociated with at least one further interaction; and generating, withat least one processor, further fraud label data for the at least onefurther interaction with the first neural network based on the furtherinteraction data, the further fraud label data for the at least onefurther interaction associated with whether the first neural networkclassifies the at least one further interaction as fraudulent.

Clause 11: A system for detecting fraudulent interactions, comprising:at least one processor; and at least one non-transitorycomputer-readable medium comprising instructions to direct the at leastone processor to: receive interaction data associated with a pluralityof interactions, the plurality of interactions comprising a firstplurality of interactions and a second plurality of interactionsdifferent than the first plurality of interactions; receive first fraudlabel data for each respective interaction of the first plurality ofinteractions, the first fraud label data associated with whether therespective interaction of the first plurality of interactions isfraudulent; generate second fraud label data for each interaction of thesecond plurality of interactions with a first neural network based onthe interaction data of the second plurality of interactions, the secondfraud label data for each respective interaction of the second pluralityof interactions associated with whether the first neural networkclassifies the respective interaction as fraudulent; generate generatedinteraction data associated with a plurality of generated interactionsand generated fraud label data for each generated interaction of theplurality of generated interactions with a second neural network;generate discrimination data for each interaction of the secondplurality of interactions and each generated interaction of theplurality of generated interactions with a third neural network based onthe interaction data for each interaction of the second plurality ofinteractions, the second fraud label data, the generated interactiondata, and the generated fraud label data, the discrimination data foreach interaction or generated interaction associated with whether thethird neural network classifies the respective interaction or generatedinteraction as real or generated; determine first error data for eachrespective interaction of the second plurality of interactions based onthe discrimination data, the first error data for each respectiveinteraction associated with whether the discrimination data for therespective interaction correctly classifies the respective interactionas real; and train the first neural network based on the first errordata associated with the interactions of the second plurality ofinteractions.

Clause 12: The system of clause 11, wherein the instructions furtherdirect the at least one processor to train the first neural networkbased on the interaction data of the first plurality of transactions andthe first fraud label data.

Clause 13: The system of clauses 11 or 12, wherein the instructionsfurther direct the at least one processor to train the first neuralnetwork based on the generated interaction data and the generated fraudlabel data.

Clause 14: The system of any one of clauses 11-13, wherein theinstructions further direct the at least one processor to: determinesecond error data for each generated interaction of the generatedinteraction data based on the discrimination data, the second error datafor each respective generated interaction associated with whether thediscrimination data for the respective generated interaction correctlyclassifies the respective generated interaction as generated; and trainthe second neural network based on the second error data associated withthe generated interactions of the generated interaction data.

Clause 15: The system of any one of clauses 11-14, wherein theinstructions further direct the at least one processor to: train thethird neural network based on at least one of the first error data, thesecond error data, the interaction data of the first plurality oftransactions, the first fraud label data, or any combination thereof.

Clause 16: The system of any one of clauses 11-15, wherein theinstructions further direct the at least one processor to generate atleast one random vector, wherein generating the generated interactiondata and the generated fraud label data comprises generating thegenerated interaction data associated with the plurality of generatedinteractions and the generated fraud label data for each generatedinteraction of the plurality of generated interactions with the secondneural network based on the at least one random vector.

Clause 17: The system of any one of clauses 11-16, wherein the firstneural network comprises a classifier, the second neural networkcomprises a generator, and the third neural network comprises adiscriminator.

Clause 18: The system of any one of clauses 11-17, wherein theinteraction data comprises a first number of features and the generatedinteraction data comprises the first number of features, wherein atleast one random vector comprises a second number of features less thanthe first number of features, wherein the generator comprises an inputfor each feature of the second number of features and an output for eachfeature of the first number of features, wherein the classifiercomprises an input for each feature of the first number of features anda single output, and wherein the discriminator comprises an input foreach feature of the first number of features and a single output.

Clause 19: The system of any one of clauses 11-18, wherein the firstneural network comprises at least one of a first multilayer perceptron(MLP), a first fully connected neural network, a first deep neuralnetwork, a first convolutional neural network, or any combinationthereof, wherein the second neural network comprises at least one of asecond MLP, a second fully connected neural network, a second deepneural network, a second convolutional neural network, or anycombination thereof, and wherein the third neural network comprises atleast one of a third MLP, a third fully connected neural network, athird deep neural network, a third convolutional neural network, or anycombination thereof.

Clause 20: The system of any one of clauses 11-19, wherein theinstructions further direct the at least one processor to: receivefurther interaction data associated with at least one furtherinteraction; and generate further fraud label data for the at least onefurther interaction with the first neural network based on the furtherinteraction data, the further fraud label data for the at least onefurther interaction associated with whether the first neural networkclassifies the at least one further interaction as fraudulent.

Clause 21: A computer program product for detecting fraudulentinteractions, the computer program product comprising at least onenon-transitory computer-readable medium including one or moreinstructions that, when executed by at least one processor, cause the atleast one processor to: receive interaction data associated with aplurality of interactions, the plurality of interactions comprising afirst plurality of interactions and a second plurality of interactionsdifferent than the first plurality of interactions; receive first fraudlabel data for each respective interaction of the first plurality ofinteractions, the first fraud label data associated with whether therespective interaction of the first plurality of interactions isfraudulent; generate second fraud label data for each interaction of thesecond plurality of interactions with a first neural network based onthe interaction data of the second plurality of interactions, the secondfraud label data for each respective interaction of the second pluralityof interactions associated with whether the first neural networkclassifies the respective interaction as fraudulent; generate generatedinteraction data associated with a plurality of generated interactionsand generated fraud label data for each generated interaction of theplurality of generated interactions with a second neural network;generate discrimination data for each interaction of the secondplurality of interactions and each generated interaction of theplurality of generated interactions with a third neural network based onthe interaction data for each interaction of the second plurality ofinteractions, the second fraud label data, the generated interactiondata, and the generated fraud label data, the discrimination data foreach interaction or generated interaction associated with whether thethird neural network classifies the respective interaction or generatedinteraction as real or generated; determine first error data for eachrespective interaction of the second plurality of interactions based onthe discrimination data, the first error data for each respectiveinteraction associated with whether the discrimination data for therespective interaction correctly classifies the respective interactionas real; and train the first neural network based on the first errordata associated with the interactions of the second plurality ofinteractions.

Clause 22: The computer program product of clause 21, wherein theinstructions further cause the at least one processor to train the firstneural network based on the interaction data of the first plurality oftransactions and the first fraud label data.

Clause 23: The computer program product of clauses 21 or 22, wherein theinstructions further cause the at least one processor to train the firstneural network based on the generated interaction data and the generatedfraud label data.

Clause 24: The computer program product of any one of clauses 21-23,wherein the instructions further cause the at least one processor to:determine second error data for each generated interaction of thegenerated interaction data based on the discrimination data, the seconderror data for each respective generated interaction associated withwhether the discrimination data for the respective generated interactioncorrectly classifies the respective generated interaction as generated;and train the second neural network based on the second error dataassociated with the generated interactions of the generated interactiondata.

Clause 25: The computer program product of any one of clauses 21-24,wherein the instructions further cause the at least one processor to:train the third neural network based on at least one of the first errordata, the second error data, the interaction data of the first pluralityof transactions, the first fraud label data, or any combination thereof.

Clause 26: The computer program product of any one of clauses 21-25,wherein the instructions further cause the at least one processor togenerate at least one random vector, wherein generating the generatedinteraction data and the generated fraud label data comprises generatingthe generated interaction data associated with the plurality ofgenerated interactions and the generated fraud label data for eachgenerated interaction of the plurality of generated interactions withthe second neural network based on the at least one random vector.

Clause 27: The computer program product of any one of clauses 21-26,wherein the first neural network comprises a classifier, the secondneural network comprises a generator, and the third neural networkcomprises a discriminator.

Clause 28: The computer program product of any one of clauses 21-27,wherein the interaction data comprises a first number of features andthe generated interaction data comprises the first number of features,wherein at least one random vector comprises a second number of featuresless than the first number of features, wherein the generator comprisesan input for each feature of the second number of features and an outputfor each feature of the first number of features, wherein the classifiercomprises an input for each feature of the first number of features anda single output, and wherein the discriminator comprises an input foreach feature of the first number of features and a single output.

Clause 29: The computer program product of any one of clauses 21-28,wherein the first neural network comprises at least one of a firstmultilayer perceptron (MLP), a first fully connected neural network, afirst deep neural network, a first convolutional neural network, or anycombination thereof, wherein the second neural network comprises atleast one of a second MLP, a second fully connected neural network, asecond deep neural network, a second convolutional neural network, orany combination thereof, and wherein the third neural network comprisesat least one of a third MLP, a third fully connected neural network, athird deep neural network, a third convolutional neural network, or anycombination thereof.

Clause 30: The computer program product of any one of clauses 21-29,wherein the instructions further cause the at least one processor to:receive further interaction data associated with at least one furtherinteraction; and generate further fraud label data for the at least onefurther interaction with the first neural network based on the furtherinteraction data, the further fraud label data for the at least onefurther interaction associated with whether the first neural networkclassifies the at least one further interaction as fraudulent.

These and other features and characteristics of the presently disclosedsubject matter, as well as the methods of operation and functions of therelated elements of structures and the combination of parts andeconomies of manufacture, will become more apparent upon considerationof the following description and the appended claims with reference tothe accompanying drawings, all of which form a part of thisspecification, wherein like reference numerals designate correspondingparts in the various figures. It is to be expressly understood, however,that the drawings are for the purpose of illustration and descriptiononly and are not intended as a definition of the limits of the disclosedsubject matter. As used in the specification and the claims, thesingular form of “a,” “an,” and “the” include plural referents unlessthe context clearly dictates otherwise.

BRIEF DESCRIPTION OF THE DRAWINGS

Additional advantages and details of the disclosed subject matter areexplained in greater detail below with reference to the exemplaryembodiments that are illustrated in the accompanying figures, in which:

FIG. 1 is a diagram of a non-limiting embodiment of an environment inwhich methods, systems, and/or computer program products, describedherein, may be implemented according to the principles of the presentlydisclosed subject matter;

FIG. 2 is a diagram of a non-limiting embodiment of components of one ormore devices of FIG. 1;

FIG. 3 is a flowchart of a non-limiting embodiment of a process foridentifying subpopulations, according to the principles of the presentlydisclosed subject matter;

FIG. 4 is a diagram of a non-limiting embodiment of an implementation ofa non-limiting embodiment of the process shown in FIG. 3, according tothe principles of the presently disclosed subject matter;

FIG. 5 is a diagram of a non-limiting embodiment of an implementation ofa non-limiting embodiment of the process shown in FIG. 3, according tothe principles of the presently disclosed subject matter; and

FIGS. 6A-6C are diagrams of non-limiting embodiments of implementationsof neural networks that may be used in non-limiting embodiments of theprocess shown in FIG. 3, according to the principles of the presentlydisclosed subject matter.

DESCRIPTION

For purposes of the description hereinafter, the terms “end,” “upper,”“lower,” “right,” “left,” “vertical,” “horizontal,” “top,” “bottom,”“lateral,” “longitudinal,” and derivatives thereof shall relate to thedisclosed subject matter as it is oriented in the drawing figures.However, it is to be understood that the disclosed subject matter mayassume various alternative variations and step sequences, except whereexpressly specified to the contrary. It is also to be understood thatthe specific devices and processes illustrated in the attached drawings,and described in the following specification, are simply exemplaryembodiments or aspects of the disclosed subject matter. Hence, specificdimensions and other physical characteristics related to the embodimentsor aspects disclosed herein are not to be considered as limiting unlessotherwise indicated.

No aspect, component, element, structure, act, step, function,instruction, and/or the like used herein should be construed as criticalor essential unless explicitly described as such. Also, as used herein,the articles “a” and “an” are intended to include one or more items andmay be used interchangeably with “one or more” and “at least one.”Furthermore, as used herein, the term “set” is intended to include oneor more items (e.g., related items, unrelated items, a combination ofrelated and unrelated items, and/or the like) and may be usedinterchangeably with “one or more” or “at least one.” Where only oneitem is intended, the term “one” or similar language is used. Also, asused herein, the terms “has,” “have,” “having,” or the like are intendedto be open-ended terms. Further, the phrase “based on” is intended tomean “based at least partially on” unless explicitly stated otherwise.

As used herein, the terms “communication” and “communicate” may refer tothe reception, receipt, transmission, transfer, provision, and/or thelike of information (e.g., data, signals, messages, instructions,commands, and/or the like). For one unit (e.g., a device, a system, acomponent of a device or system, combinations thereof, and/or the like)to be in communication with another unit means that the one unit is ableto directly or indirectly receive information from and/or transmitinformation to the other unit. This may refer to a direct or indirectconnection (e.g., a direct communication connection, an indirectcommunication connection, and/or the like) that is wired and/or wirelessin nature. Additionally, two units may be in communication with eachother even though the information transmitted may be modified,processed, relayed, and/or routed between the first and second unit. Forexample, a first unit may be in communication with a second unit eventhough the first unit passively receives information and does notactively transmit information to the second unit. As another example, afirst unit may be in communication with a second unit if at least oneintermediary unit (e.g., a third unit located between the first unit andthe second unit) processes information received from the first unit andcommunicates the processed information to the second unit. In somenon-limiting embodiments, a message may refer to a network packet (e.g.,a data packet and/or the like) that includes data. It will beappreciated that numerous other arrangements are possible.

As used herein, the terms “issuer institution,” “portable financialdevice issuer,” “issuer,” or “issuer bank” may refer to one or moreentities that provide accounts to customers for conducting transactions(e.g., payment transactions), such as initiating credit and/or debitpayments. For example, an issuer institution may provide an accountidentifier, such as a primary account number (PAN), to a customer thatuniquely identifies one or more accounts associated with that customer.The account identifier may be embodied on a portable financial device,such as a physical financial instrument, e.g., a payment card, and/ormay be electronic and used for electronic payments. The terms “issuerinstitution” and “issuer institution system” may also refer to one ormore computer systems operated by or on behalf of an issuer institution,such as a server computer executing one or more software applications.For example, an issuer institution system may include one or moreauthorization servers for authorizing a transaction.

As used herein, the term “account identifier” may include one or moretypes of identifiers associated with a user account (e.g., a PAN, a cardnumber, a payment card number, a token, and/or the like). In somenon-limiting embodiments, an issuer institution may provide an accountidentifier (e.g., a PAN, a token, and/or the like) to a user thatuniquely identifies one or more accounts associated with that user. Theaccount identifier may be embodied on a physical financial instrument(e.g., a portable financial instrument, a payment card, a credit card, adebit card, and/or the like) and/or may be electronic informationcommunicated to the user that the user may use for electronic payments.In some non-limiting embodiments, the account identifier may be anoriginal account identifier, where the original account identifier wasprovided to a user at the creation of the account associated with theaccount identifier. In some non-limiting embodiments, the accountidentifier may be an account identifier (e.g., a supplemental accountidentifier) that is provided to a user after the original accountidentifier was provided to the user. For example, if the originalaccount identifier is forgotten, stolen, and/or the like, a supplementalaccount identifier may be provided to the user. In some non-limitingembodiments, an account identifier may be directly or indirectlyassociated with an issuer institution such that an account identifiermay be a token that maps to a PAN or other type of identifier. Accountidentifiers may be alphanumeric, any combination of characters and/orsymbols, and/or the like. An issuer institution may be associated with abank identification number (BIN) that uniquely identifies the issuerinstitution.

As used herein, the terms “payment token” or “token” may refer to anidentifier that is used as a substitute or replacement identifier for anaccount identifier, such as a PAN. Tokens may be associated with a PANor other account identifiers in one or more data structures (e.g., oneor more databases and/or the like) such that they can be used to conducta transaction (e.g., a payment transaction) without directly using theaccount identifier, such as a PAN. In some examples, an accountidentifier, such as a PAN, may be associated with a plurality of tokensfor different individuals, different uses, and/or different purposes.For example, a payment token may include a series of numeric and/oralphanumeric characters that may be used as a substitute for an originalaccount identifier. For example, a payment token “4900 0000 0000 0001”may be used in place of a PAN “4147 0900 0000 1234.” In somenon-limiting embodiments, a payment token may be “format preserving” andmay have a numeric format that conforms to the account identifiers usedin existing payment processing networks (e.g., ISO 8583 financialtransaction message format). In some non-limiting embodiments, a paymenttoken may be used in place of a PAN to initiate, authorize, settle, orresolve a payment transaction or represent the original credential inother systems where the original credential would typically be provided.In some non-limiting embodiments, a token value may be generated suchthat the recovery of the original PAN or other account identifier fromthe token value may not be computationally derived (e.g., with a one-wayhash or other cryptographic function). Further, in some non-limitingembodiments, the token format may be configured to allow the entityreceiving the payment token to identify it as a payment token andrecognize the entity that issued the token.

As used herein, the term “provisioning” may refer to a process ofenabling a device to use a resource or service. For example,provisioning may involve enabling a device to perform transactions usingan account. Additionally or alternatively, provisioning may includeadding provisioning data associated with account data (e.g., a paymenttoken representing an account number) to a device.

As used herein, the term “token requestor” may refer to an entity thatis seeking to implement tokenization according to embodiments of thepresently disclosed subject matter. For example, the token requestor mayinitiate a request that a PAN be tokenized by submitting a token requestmessage to a token service provider. Additionally or alternatively, atoken requestor may no longer need to store a PAN associated with atoken once the requestor has received the payment token in response to atoken request message. In some non-limiting embodiments, the requestormay be an application, a device, a process, or a system that isconfigured to perform actions associated with tokens. For example, arequestor may request registration with a network token system, requesttoken generation, token activation, token de-activation, token exchange,other token lifecycle management related processes, and/or any othertoken related processes. In some non-limiting embodiments, a requestormay interface with a network token system through any suitablecommunication network and/or protocol (e.g., using HTTPS, SOAP, and/oran XML interface among others). For example, a token requestor mayinclude card-on-file merchants, acquirers, acquirer processors, paymentgateways acting on behalf of merchants, payment enablers (e.g., originalequipment manufacturers, mobile network operators, and/or the like),digital wallet providers, issuers, third-party wallet providers, paymentprocessing networks, and/or the like. In some non-limiting embodiments,a token requestor may request tokens for multiple domains and/orchannels. Additionally or alternatively, a token requestor may beregistered and identified uniquely by the token service provider withinthe tokenization ecosystem. For example, during token requestorregistration, the token service provider may formally process a tokenrequestor's application to participate in the token service system. Insome non-limiting embodiments, the token service provider may collectinformation pertaining to the nature of the requestor and relevant useof tokens to validate and formally approve the token requestor andestablish appropriate domain restriction controls. Additionally oralternatively, successfully registered token requestors may be assigneda token requestor identifier that may also be entered and maintainedwithin the token vault. In some non-limiting embodiments, tokenrequestor identifiers may be revoked and/or token requestors may beassigned new token requestor identifiers. In some non-limitingembodiments, this information may be subject to reporting and audit bythe token service provider.

As used herein, the term a “token service provider” may refer to anentity including one or more server computers in a token service systemthat generates, processes, and maintains payment tokens. For example,the token service provider may include or be in communication with atoken vault where the generated tokens are stored. Additionally oralternatively, the token vault may maintain one-to-one mapping between atoken and a PAN represented by the token. In some non-limitingembodiments, the token service provider may have the ability to setaside licensed BINs as token BINs to issue tokens for the PANs that maybe submitted to the token service provider. In some non-limitingembodiments, various entities of a tokenization ecosystem may assume theroles of the token service provider. For example, payment networks andissuers or their agents may become the token service provider byimplementing the token services according to non-limiting embodiments ofthe presently disclosed subject matter. Additionally or alternatively, atoken service provider may provide reports or data output to reportingtools regarding approved, pending, or declined token requests, includingany assigned token requestor ID. The token service provider may providedata output related to token-based transactions to reporting tools andapplications and present the token and/or PAN as appropriate in thereporting output. In some non-limiting embodiments, the EMVCo standardsorganization may publish specifications defining how tokenized systemsmay operate. For example, such specifications may be informative, butthey are not intended to be limiting upon any of the presently disclosedsubject matter.

As used herein, the term “token vault” may refer to a repository thatmaintains established token-to-PAN mappings. For example, the tokenvault may also maintain other attributes of the token requestor that maybe determined at the time of registration and/or that may be used by thetoken service provider to apply domain restrictions or other controlsduring transaction processing. In some non-limiting embodiments, thetoken vault may be a part of a token service system. For example, thetoken vault may be provided as a part of the token service provider.Additionally or alternatively, the token vault may be a remoterepository accessible by the token service provider. In somenon-limiting embodiments, token vaults, due to the sensitive nature ofthe data mappings that are stored and managed therein, may be protectedby strong underlying physical and logical security. Additionally oralternatively, a token vault may be operated by any suitable entity,including a payment network, an issuer, clearing houses, other financialinstitutions, transaction service providers, and/or the like.

As used herein, the term “merchant” may refer to one or more entities(e.g., operators of retail businesses that provide goods and/orservices, and/or access to goods and/or services, to a user (e.g., acustomer, a consumer, a customer of the merchant, and/or the like) basedon a transaction (e.g., a payment transaction)). As used herein,“merchant system” may refer to one or more computer systems operated byor on behalf of a merchant, such as a server computer executing one ormore software applications. As used herein, the term “product” may referto one or more goods and/or services offered by a merchant.

As used herein, the term “point-of-sale (POS) device” may refer to oneor more devices, which may be used by a merchant to initiatetransactions (e.g., a payment transaction), engage in transactions,and/or process transactions. For example, a POS device may include oneor more computers, peripheral devices, card readers, near-fieldcommunication (NFC) receivers, radio frequency identification (RFID)receivers, and/or other contactless transceivers or receivers,contact-based receivers, payment terminals, computers, servers, inputdevices, and/or the like.

As used herein, the term “point-of-sale (POS) system” may refer to oneor more computers and/or peripheral devices used by a merchant toconduct a transaction. For example, a POS system may include one or morePOS devices and/or other like devices that may be used to conduct apayment transaction. A POS system (e.g., a merchant POS system) may alsoinclude one or more server computers programmed or configured to processonline payment transactions through webpages, mobile applications,and/or the like.

As used herein, the term “transaction service provider” may refer to anentity that receives transaction authorization requests from merchantsor other entities and provides guarantees of payment, in some casesthrough an agreement between the transaction service provider and theissuer institution. In some non-limiting embodiments, a transactionservice provider may include a credit card company, a debit cardcompany, and/or the like. As used herein, the term “transaction serviceprovider system” may also refer to one or more computer systems operatedby or on behalf of a transaction service provider, such as a transactionprocessing server executing one or more software applications. Atransaction processing server may include one or more processors and, insome non-limiting embodiments, may be operated by or on behalf of atransaction service provider.

As used herein, the term “acquirer” may refer to an entity licensed bythe transaction service provider and approved by the transaction serviceprovider to originate transactions (e.g., payment transactions) using aportable financial device associated with the transaction serviceprovider. As used herein, the term “acquirer system” may also refer toone or more computer systems, computer devices, and/or the like operatedby or on behalf of an acquirer. The transactions the acquirer mayinclude payment transactions (e.g., purchases, original credittransactions (OCTs), account funding transactions (AFTs), and/or thelike). In some non-limiting embodiments, the acquirer may be authorizedby the transaction service provider to assign merchant or serviceproviders to originate transactions using a portable financial device ofthe transaction service provider. The acquirer may contract with paymentfacilitators to enable the payment facilitators to sponsor merchants.The acquirer may monitor compliance of the payment facilitators inaccordance with regulations of the transaction service provider. Theacquirer may conduct due diligence of the payment facilitators andensure that proper due diligence occurs before signing a sponsoredmerchant. The acquirer may be liable for all transaction serviceprovider programs that the acquirer operates or sponsors. The acquirermay be responsible for the acts of the acquirer's payment facilitators,merchants that are sponsored by an acquirer's payment facilitators,and/or the like. In some non-limiting embodiments, an acquirer may be afinancial institution, such as a bank.

As used herein, the terms “electronic wallet,” “electronic wallet mobileapplication,” and “digital wallet” may refer to one or more electronicdevices and/or one or more software applications configured to initiateand/or conduct transactions (e.g., payment transactions, electronicpayment transactions, and/or the like). For example, an electronicwallet may include a user device (e.g., a mobile device) executing anapplication program and server-side software and/or databases formaintaining and providing transaction data to the user device. As usedherein, the term “electronic wallet provider” may include an entity thatprovides and/or maintains an electronic wallet and/or an electronicwallet mobile application for a user (e.g., a customer). Examples of anelectronic wallet provider include, but are not limited to, Google Pay®,Android Pay®, Apple Pay®, and Samsung Pay®. In some non-limitingexamples, a financial institution (e.g., an issuer institution) may bean electronic wallet provider. As used herein, the term “electronicwallet provider system” may refer to one or more computer systems,computer devices, servers, groups of servers, and/or the like operatedby or on behalf of an electronic wallet provider.

As used herein, the term “portable financial device” may refer to apayment card (e.g., a credit or debit card), a gift card, a smartcard,smart media, a payroll card, a healthcare card, a wrist band, amachine-readable medium containing account information, a keychaindevice or fob, an RFID transponder, a retailer discount or loyalty card,a cellular phone, an electronic wallet mobile application, a personaldigital assistant (PDA), a pager, a security card, a computer, an accesscard, a wireless terminal, a transponder, and/or the like. In somenon-limiting embodiments, the portable financial device may includevolatile or non-volatile memory to store information (e.g., an accountidentifier, a name of the account holder, and/or the like).

As used herein, the term “payment gateway” may refer to an entity and/ora payment processing system operated by or on behalf of such an entity(e.g., a merchant service provider, a payment service provider, apayment facilitator, a payment facilitator that contracts with anacquirer, a payment aggregator, and/or the like), which provides paymentservices (e.g., transaction service provider payment services, paymentprocessing services, and/or the like) to one or more merchants. Thepayment services may be associated with the use of portable financialdevices managed by a transaction service provider. As used herein, theterm “payment gateway system” may refer to one or more computer systems,computer devices, servers, groups of servers, and/or the like operatedby or on behalf of a payment gateway and/or to a payment gateway itself.The term “payment gateway mobile application” may refer to one or moreelectronic devices and/or one or more software applications configuredto provide payment services for transactions (e.g., paymenttransactions, electronic payment transactions, and/or the like).

As used herein, the terms “client” and “client device” may refer to oneor more client-side devices or systems (e.g., remote from a transactionservice provider) used to initiate or facilitate a transaction (e.g., apayment transaction). As an example, a “client device” may refer to oneor more POS devices used by a merchant, one or more acquirer hostcomputers used by an acquirer, one or more mobile devices used by auser, and/or the like. In some non-limiting embodiments, a client devicemay be an electronic device configured to communicate with one or morenetworks and initiate or facilitate transactions. For example, a clientdevice may include one or more computers, portable computers, laptopcomputers, tablet computers, mobile devices, cellular phones, wearabledevices (e.g., watches, glasses, lenses, clothing, and/or the like),PDAs, and/or the like. Moreover, a “client” may also refer to an entity(e.g., a merchant, an acquirer, and/or the like) that owns, utilizes,and/or operates a client device for initiating transactions (e.g., forinitiating transactions with a transaction service provider).

As used herein, the term “server” may refer to one or more computingdevices (e.g., processors, storage devices, similar computer components,and/or the like) that communicate with client devices and/or othercomputing devices over a network (e.g., a public network, the Internet,a private network, and/or the like) and, in some examples, facilitatecommunication among other servers and/or client devices. It will beappreciated that various other arrangements are possible. As usedherein, the term “system” may refer to one or more computing devices orcombinations of computing devices (e.g., processors, servers, clientdevices, software applications, components of such, and/or the like).Reference to “a device,” “a server,” “a processor,” and/or the like, asused herein, may refer to a previously-recited device, server, orprocessor that is recited as performing a previous step or function, adifferent server or processor, and/or a combination of servers and/orprocessors. For example, as used in the specification and the claims, afirst server or a first processor that is recited as performing a firststep or a first function may refer to the same or different server orthe same or different processor recited as performing a second step or asecond function.

Non-limiting embodiments of the disclosed subject matter are directed tosystems, methods, and computer program products for detecting fraudulentinteractions, including, but not limited to, detecting fraudulentinteractions using multiple neural networks. For example, non-limitingembodiments of the disclosed subject matter provide detecting fraudulentinteractions using three neural networks (e.g., a classifier, agenerator, a discriminator, and/or the like) to generate labels forunlabeled interaction data (e.g., by the classifier), generate generated(e.g., fake) interaction data (e.g., by the generator), generatediscrimination data for the unlabeled interactions and generatedinteractions (e.g., be the discriminator), and generate error data basedon the discrimination data to use for training at least one of theneural networks. Such embodiments provide techniques and systems thatreduce (e.g., eliminate, decrease, and/or the like) manual efforts andreduce time spent manually reviewing transactions (e.g., to providelabels to historical transaction data, to identify incoming transactionsas fraudulent, and/or the like). Additionally or alternatively, suchembodiments provide techniques and systems that accurately providelabels for unlabeled data (e.g., historical data, incoming data, and/orthe like). As such, the previously unlabeled data may be used formachine learning (e.g., supervised learning and/or the like) for whichit was previously unsuitable (e.g., unusable, usable only after labelswere manually assigned, and/or the like). Additionally or alternatively,such embodiments provide techniques and systems that enable detection ofnew patterns, complex patterns, and/or the like that may not have beenpreviously detectable (e.g., because the small portion of data that waslabeled was insufficiently small to train a machine learning model,because predetermined rules are difficult to (manually) adjust in realtime and/or when patterns are unknown to the designer, and/or the like).Additionally or alternatively, such embodiments provide techniques andsystems that enable training a classifier to accurately label real databased in part on feedback from a discriminator that is discriminatingbetween real and fake (e.g., generated) data. For example, the outputand/or error data from the discriminator may be indirectly indicative ofthe accuracy of such labels provided by the classifier for (real)previously unlabeled data.

For the purpose of illustration, in the following description, while thepresently disclosed subject matter is described with respect to methods,systems, and computer program products for detecting fraudulentinteractions, e.g., fraudulent payment transactions, one skilled in theart will recognize that the disclosed subject matter is not limited tothe illustrative embodiments. For example, the methods, systems, andcomputer program products described herein may be used with a widevariety of settings, such as detecting fraudulent interactions in anysuitable setting, e.g., non-payment transactions, interactions over anetwork, interactions over social media, and/or the like.

Referring now to FIG. 1, FIG. 1 is a diagram of a non-limitingembodiment of an environment 100 in which systems, products, and/ormethods, as described herein, may be implemented. As shown in FIG. 1,environment 100 includes transaction service provider system 102, issuersystem 104, customer device 106, merchant system 108, acquirer system110, and network 112.

Transaction service provider system 102 may include one or more devicescapable of receiving information from and/or communicating informationto issuer system 104, customer device 106, merchant system 108, and/oracquirer system 110 via network 112. For example, transaction serviceprovider system 102 may include a computing device, such as a server(e.g., a transaction processing server), a group of servers, and/orother like devices. In some non-limiting embodiments, transactionservice provider system 102 may be associated with a transaction serviceprovider as described herein. In some non-limiting embodiments,transaction service provider system 102 may be in communication with adata storage device, which may be local or remote to transaction serviceprovider system 102. In some non-limiting embodiments, transactionservice provider system 102 may be capable of receiving informationfrom, storing information in, communicating information to, or searchinginformation stored in the data storage device.

Issuer system 104 may include one or more devices capable of receivinginformation and/or communicating information to transaction serviceprovider system 102, customer device 106, merchant system 108, and/oracquirer system 110 via network 112. For example, issuer system 104 mayinclude a computing device, such as a server, a group of servers, and/orother like devices. In some non-limiting embodiments, issuer system 104may be associated with an issuer institution as described herein. Forexample, issuer system 104 may be associated with an issuer institutionthat issued a credit account, debit account, credit card, debit card,and/or the like to a user associated with customer device 106.

Customer device 106 may include one or more devices capable of receivinginformation from and/or communicating information to transaction serviceprovider system 102, issuer system 104, merchant system 108, and/oracquirer system 110 via network 112. Additionally or alternatively, eachcustomer device 106 may include a device capable of receivinginformation from and/or communicating information to other customerdevices 106 via network 112, another network (e.g., an ad hoc network, alocal network, a private network, a virtual private network, and/or thelike), and/or any other suitable communication technique. For example,customer device 106 may include a client device and/or the like. In somenon-limiting embodiments, customer device 106 may or may not be capableof receiving information (e.g., from merchant system 108 or from anothercustomer device 106) via a short-range wireless communication connection(e.g., an NFC communication connection, an RFID communicationconnection, a Bluetooth® communication connection, a Zigbee®communication connection, and/or the like), and/or communicatinginformation (e.g., to merchant system 108) via a short-range wirelesscommunication connection.

Merchant system 108 may include one or more devices capable of receivinginformation from and/or communicating information to transaction serviceprovider system 102, issuer system 104, customer device 106, and/oracquirer system 110 via network 112. Merchant system 108 may alsoinclude a device capable of receiving information from customer device106 via network 112, a communication connection (e.g., an NFCcommunication connection, an RFID communication connection, a Bluetooth®communication connection, a Zigbee® communication connection, and/or thelike) with customer device 106, and/or the like, and/or communicatinginformation to customer device 106 via the network, the communicationconnection, and/or the like. In some non-limiting embodiments, merchantsystem 108 may include a computing device, such as a server, a group ofservers, a client device, a group of client devices, and/or other likedevices. In some non-limiting embodiments, merchant system 108 may beassociated with a merchant as described herein. In some non-limitingembodiments, merchant system 108 may include one or more client devices.For example, merchant system 108 may include a client device that allowsa merchant to communicate information to transaction service providersystem 102. In some non-limiting embodiments, merchant system 108 mayinclude one or more devices, such as computers, computer systems, and/orperipheral devices capable of being used by a merchant to conduct atransaction with a user. For example, merchant system 108 may include aPOS device and/or a POS system.

Acquirer system 110 may include one or more devices capable of receivinginformation from and/or communicating information to transaction serviceprovider system 102, issuer system 104, customer device 106, and/ormerchant system 108 via network 112. For example, acquirer system 110may include a computing device, a server, a group of servers, and/or thelike. In some non-limiting embodiments, acquirer system 110 may beassociated with an acquirer as described herein.

Network 112 may include one or more wired and/or wireless networks. Forexample, network 112 may include a cellular network (e.g., a long-termevolution (LTE) network, a third generation (3G) network, a fourthgeneration (4G) network, a code division multiple access (CDMA) network,and/or the like), a public land mobile network (PLMN), a local areanetwork (LAN), a wide area network (WAN), a metropolitan area network(MAN), a telephone network (e.g., the public switched telephone network(PSTN)), a private network (e.g., a private network associated with atransaction service provider), an ad hoc network, an intranet, theInternet, a fiber optic-based network, a cloud computing network, and/orthe like, and/or a combination of these or other types of networks.

The number and arrangement of systems, devices, and/or networks shown inFIG. 1 are provided as an example. There may be additional systems,devices, and/or networks; fewer systems, devices, and/or networks;different systems, devices, and/or networks; and/or differently arrangedsystems, devices, and/or networks than those shown in FIG. 1.Furthermore, two or more systems or devices shown in FIG. 1 may beimplemented within a single system or device, or a single system ordevice shown in FIG. 1 may be implemented as multiple, distributedsystems or devices. Additionally or alternatively, a set of systems(e.g., one or more systems) or a set of devices (e.g., one or moredevices) of environment 100 may perform one or more functions describedas being performed by another set of systems or another set of devicesof environment 100.

Referring now to FIG. 2, FIG. 2 is a diagram of example components of adevice 200. Device 200 may correspond to one or more devices oftransaction service provider system 102, one or more devices of issuersystem 104, customer device 106, one or more devices of merchant system108, and/or one or more devices of acquirer system 110. In somenon-limiting embodiments, transaction service provider system 102,issuer system 104, customer device 106, merchant system 108, and/oracquirer system 110 may include at least one device 200 and/or at leastone component of device 200. As shown in FIG. 2, device 200 may includebus 202, processor 204, memory 206, storage component 208, inputcomponent 210, output component 212, and communication interface 214.

Bus 202 may include a component that permits communication among thecomponents of device 200. In some non-limiting embodiments, processor204 may be implemented in hardware, software, or a combination ofhardware and software. For example, processor 204 may include aprocessor (e.g., a central processing unit (CPU), a graphics processingunit (GPU), an accelerated processing unit (APU), and/or the like), amicroprocessor, a digital signal processor (DSP), and/or any processingcomponent (e.g., a field-programmable gate array (FPGA), anapplication-specific integrated circuit (ASIC), and/or the like), and/orthe like, which can be programmed to perform a function. Memory 206 mayinclude random access memory (RAM), read-only memory (ROM), and/oranother type of dynamic or static storage device (e.g., flash memory,magnetic memory, optical memory, and/or the like) that storesinformation and/or instructions for use by processor 204.

Storage component 208 may store information and/or software related tothe operation and use of device 200. For example, storage component 208may include a hard disk (e.g., a magnetic disk, an optical disk, amagneto-optic disk, a solid state disk, and/or the like), a compact disc(CD), a digital versatile disc (DVD), a floppy disk, a cartridge, amagnetic tape, and/or another type of computer-readable medium, alongwith a corresponding drive.

Input component 210 may include a component that permits device 200 toreceive information, such as via user input (e.g., a touch screendisplay, a keyboard, a keypad, a mouse, a button, a switch, amicrophone, a camera, and/or the like). Additionally or alternatively,input component 210 may include a sensor for sensing information (e.g.,a global positioning system (GPS) component, an accelerometer, agyroscope, an actuator, and/or the like). Output component 212 mayinclude a component that provides output information from device 200(e.g., a display, a speaker, one or more light-emitting diodes (LEDs),and/or the like).

Communication interface 214 may include a transceiver-like component(e.g., a transceiver, a receiver and transmitter that are separate,and/or the like) that enables device 200 to communicate with otherdevices, such as via a wired connection, a wireless connection, or acombination of wired and wireless connections. Communication interface214 may permit device 200 to receive information from another deviceand/or provide information to another device. For example, communicationinterface 214 may include an Ethernet interface, an optical interface, acoaxial interface, an infrared interface, a radio frequency (RF)interface, a universal serial bus (USB) interface, a Wi-Fi® interface, aBluetooth® interface, a Zigbee® interface, a cellular network interface,and/or the like.

Device 200 may perform one or more processes described herein. Device200 may perform these processes based on processor 204 executingsoftware instructions stored by a computer-readable medium, such asmemory 206 and/or storage component 208. A computer-readable medium(e.g., a non-transitory computer-readable medium) is defined herein as anon-transitory memory device. A non-transitory memory device includesmemory space located inside of a single physical storage device ormemory space spread across multiple physical storage devices.

Software instructions may be read into memory 206 and/or storagecomponent 208 from another computer-readable medium or from anotherdevice via communication interface 214. When executed, softwareinstructions stored in memory 206 and/or storage component 208 may causeprocessor 204 to perform one or more processes described herein.Additionally or alternatively, hardwired circuitry may be used in placeof or in combination with software instructions to perform one or moreprocesses described herein. Thus, embodiments described herein are notlimited to any specific combination of hardware circuitry and software.

The number and arrangement of components shown in FIG. 2 are provided asan example. In some non-limiting embodiments, device 200 may includeadditional components, fewer components, different components, ordifferently arranged components than those shown in FIG. 2. Additionallyor alternatively, a set of components (e.g., one or more components) ofdevice 200 may perform one or more functions described as beingperformed by another set of components of device 200.

Referring now to FIG. 3, FIG. 3 is a flowchart of a non-limitingembodiment of a process 300 for detecting fraudulent interactions. Insome non-limiting embodiments, one or more of the steps of process 300may be performed (e.g., completely, partially, and/or the like) bytransaction service provider system 102 (e.g., one or more devices oftransaction service provider system 102). In some non-limitingembodiments, one or more of the steps of process 300 may be performed(e.g., completely, partially, and/or the like) by another system,another device, another group of systems, or another group of devices,separate from or including transaction service provider system 102, suchas issuer system 104 (e.g., one or more devices of issuer system 104),customer device 106, merchant system 108 (e.g., one or more devices ofmerchant system 108), acquirer system 110 (e.g., one or more devices ofacquirer system 110), and/or the like. In some non-limiting embodiments,a central system may be implemented (e.g., completely, partially, and/orthe like) by transaction service provider system 102. In somenon-limiting embodiments, a central system may be implemented (e.g.,completely, partially, and/or the like) by another system, anotherdevice, another group of systems, or another group of devices, separatefrom or including transaction service provider system 102, such asissuer system 104, customer device 106, merchant system 108, acquirersystem 110, and/or the like.

As shown in FIG. 3, at step 302, process 300 may include receivinginteraction data. For example, a central system (e.g., transactionservice provider system 102 and/or the like) may receive interactiondata (e.g., payment transaction data, non-payment transaction data,communication data, and/or the like, as described herein) associatedwith a plurality of interactions. In some non-limiting embodiments, thecentral system (e.g., transaction service provider system 102 and/or thelike) may receive interaction data from at least one other device and/orsystem separate from the central system (e.g., receive interaction datafrom at least one of issuer system 104, customer device 106, merchantsystem 108, acquirer system 110, and/or the like). Additionally oralternatively, the central system (e.g., transaction service providersystem 102 and/or the like) may receive (e.g., retrieve and/or the like)at least some of the interaction data from a data storage device, whichmay be local or remote to the central system.

In some non-limiting embodiments, interaction data may includetransaction data (e.g., payment transaction data) associated with aplurality of transactions (e.g., payment transactions). Additionally oralternatively, interaction data may include communication dataassociated with a plurality of communications (e.g., public and/orprivate messages, emails, text messages, telephone calls, voice overinternet protocol (VoIP) calls, social media posts, web browsing, and/orthe like). In some non-limiting embodiments, interaction data mayinclude a plurality of features (e.g., fields, parameters, values,strings, properties, characteristics, measurements, and/or the like).

In some non-limiting embodiments, the plurality of interactions mayinclude a first plurality of interactions and a second plurality ofinteractions different than the first plurality of interactions. Forexample, the first plurality of interactions may include interactionsfor which labels (e.g., fraud labels indicating whether or not eachinteraction is fraudulent and/or the like, as described herein) areavailable. Additionally or alternatively, the second plurality ofinteractions may include interactions for which labels (e.g., fraudlabels and/or the like) are not available. For example, the secondplurality of interactions may be initially unlabeled.

As shown in FIG. 3, at step 304, process 300 may include receivinglabels. For example, a central system (e.g., transaction serviceprovider system 102 and/or the like) may receive label data (e.g., fraudlabel data and/or the like) for at least some of the interactions (e.g.,the first plurality of interactions). In some non-limiting embodiments,the label data (e.g., fraud label data and/or the like) may be includedwith the interaction data of at least some of the interactions (e.g.,the first plurality of interactions), and such label data may bereceived simultaneously with such interaction data. Additionally oralternatively, the central system (e.g., transaction service providersystem 102 and/or the like) may receive label data from at least oneother device and/or system separate from the central system (e.g.,receive interaction data from at least one of issuer system 104,customer device 106, merchant system 108, acquirer system 110, and/orthe like). Additionally or alternatively, the central system (e.g.,transaction service provider system 102 and/or the like) may receive(e.g., retrieve and/or the like) at least some of the label data from adata storage device, which may be local or remote to the central system.Additionally or alternatively, the central system (e.g., transactionservice provider system 102 and/or the like) may receive at least someof the label data from at least one user device of the central systemassociated with a user (e.g., an agent tasked with reviewing at leastsome of the first plurality of interactions to provide a fraud labeltherefor).

In some non-limiting embodiments, the label data may include fraud labeldata. For example, the central system (e.g., transaction serviceprovider system 102 and/or the like) may receive (first) fraud labeldata for each respective interaction of at least some of theinteractions (e.g., the first plurality of interactions). Additionallyor alternatively, the (first) fraud label data may be associated withwhether the respective interaction (e.g., of the first plurality ofinteractions) is fraudulent. In some non-limiting embodiments, the fraudlabel data may include a single bit or Boolean value. For example, thefraud label (e.g., bit or Boolean value) may be 1 or “True,”respectively, if the associated interaction is fraudulent, and 0 or“False” otherwise. In some non-limiting embodiments, the fraud labeldata may include two bits or Boolean values. For example, a first bit orBoolean value may be 1 or “True,” respectively, if the associatedinteraction is fraudulent (and 0 or “False” otherwise), and a second bitor Boolean value may be 1 or “True,” respectively, if the associatedinteraction is not fraudulent (and 0 or “False” otherwise). Additionallyor alternatively, if both the first bit or Boolean value and second bitor Boolean value 0 or “False,” respectively, that may indicate that alabel has not been provided (e.g., determined and/or the like). In somenon-limiting embodiments, the fraud label data may include a numericalvalue associated with a probability that the interaction is fraudulent.For example, such numerical value may be a number between 0 and 1,between 0 and 100, and/or the like.

As shown in FIG. 3, at step 306, process 300 may include generatinglabels (e.g., for initially unlabeled data). For example, a centralsystem (e.g., transaction service provider system 102 and/or the like)may generate (second) label data for at least some interactions (e.g.,the second plurality of interactions) with a first neural network (e.g.,classifier and/or the like) based on the interaction data (e.g., of eachinteraction of the second plurality of interactions).

In some non-limiting embodiments, the (second) label data may include(second) fraud label data. For example, the (second) fraud label datafor each respective interaction of the second plurality of interactionsmay be associated with whether the first neural network classifies therespective interaction as fraudulent. In some non-limiting embodiments,the (second) fraud label data may include a single bit or Boolean value,as described herein. Additionally or alternatively, the (second) fraudlabel data may include two bits or Boolean values, as described herein.Additionally or alternatively, the (second) fraud label data may includea numerical value associated with a probability that the interaction isfraudulent, as described herein. For example, the output of the firstneural network (e.g., classifier and/or the like) may be the numericalvalue.

In some non-limiting embodiments, the central system may input thefeatures of the interaction data to the first neural network (e.g.,classifier and/or the like) and/or use the first neural network togenerate the (second) label data based on the features of theinteraction data. In some non-limiting embodiments, the interaction datamay include a first number of features. Additionally or alternatively,the first neural network (e.g., classifier) may include an input foreach feature of the first number of features. Additionally oralternatively, the first neural network (e.g., classifier) may includeat least one output based on the (second) fraud label data. For example,where the (second) fraud label data includes a single bit or Booleanvalue, the first neural network (e.g., classifier) may include a singleoutput (e.g., a bit or Boolean value as output). For example, where the(second) fraud label data includes two bits or Boolean values, the firstneural network (e.g., classifier) may include two outputs (e.g., twobits or Boolean values as output). For example, where the (second) fraudlabel data includes a numerical value, the first neural network (e.g.,classifier) may include a single output (e.g., a numerical value asoutput).

In some non-limiting embodiments, the first neural network (e.g.,classifier and/or the like) may include at least one of a firstmultilayer perceptron (MLP), a first fully connected neural network, afirst deep neural network, a first convolutional neural network, anycombination thereof, and/or the like. For example, the first neuralnetwork (e.g., classifier and/or the like) may be a first fullyconnected neural network including an input layer with at least oneinput, an output layer with at least one output, and at least one hiddenlayer between the input layer and the output layer. In some non-limitingembodiments, the at least one hidden layer may include at least threehidden layers, up to five hidden layers, and/or the like.

As shown in FIG. 3, at step 308, process 300 may include generatinggenerated (e.g., fake) interaction data. For example, a central system(e.g., transaction service provider system 102 and/or the like) maygenerate generated (e.g., fake) interaction data associated with aplurality of generated (e.g., fake) interactions with a second neuralnetwork (e.g., generator and/or the like). Additionally oralternatively, the central system may generate generated (e.g., fake)label data (e.g., generated fraud label data and/or the like) for eachgenerated interaction of the plurality of generated interactions withthe second neural network (e.g., generator and/or the like). In somenon-limiting embodiments, the generated label data (e.g., generatedfraud label data and/or the like) may be included with the interactiondata of the generated interactions (e.g., of each generatedinteraction). Additionally or alternatively, such generated label data(e.g., generated fraud label data and/or the like) may be generatedsimultaneously with such generated interaction data.

In some non-limiting embodiments, generated interaction data may includegenerated transaction data (e.g., generated payment transaction data)associated with a plurality of generated transactions (e.g., generatedpayment transactions). Additionally or alternatively, generatedinteraction data may include communication data associated with aplurality of generated communications (e.g., generated public and/orprivate messages, emails, text messages, telephone calls, voice overinternet protocol (VoIP) calls, social media posts, web browsing, and/orthe like). In some non-limiting embodiments, generated interaction datamay include a plurality of generated features (e.g., fields, parameters,values, strings, properties, characteristics, measurements, and/or thelike). For example, the generated features may resemble the (real)features of the (real) interaction data. Additionally or alternatively,the generated features may include the same number of features and/orthe same types of feature as the (real) interaction data.

In some non-limiting embodiments, the generated label data may includegenerated fraud label data. For example, the generated fraud label datafor each respective generated interaction may be associated with whetherthe second neural network generated the respective generated interactionto resemble a fraudulent interaction. In some non-limiting embodiments,the generated label data may include a single bit or Boolean value, asdescribed herein. Additionally or alternatively, the generated fraudlabel data may include two bits or Boolean values, as described herein.Additionally or alternatively, the generated fraud label data mayinclude a numerical value associated with a probability that thegenerated interaction would be classified as fraudulent, as describedherein. For example, the output of the second neural network (e.g.,generator and/or the like) may include the numerical value.

In some non-limiting embodiments, the central system may generate atleast one random vector. For example, the at least one random vector mayinclude a vector of randomly generated features (e.g., randomlygenerated numerical values and/or the like). Additionally oralternatively, the central system may generate the generated interactiondata associated with the plurality of generated interactions and/or thegenerated fraud label data for each generated interaction of theplurality of generated interactions with the second neural network(e.g., generator and/or the like) based on the at least one randomvector. In some non-limiting embodiments, the central system may inputthe features of the at least one random vector to the second neuralnetwork (e.g., generator and/or the like) and/or use the second neuralnetwork to generate the generated interaction data and/or the generated(fraud) label data based on the features of the at least one randomvector. In some non-limiting embodiments, the generated interaction datamay include the first number of features (e.g., the same number offeatures as the (real) interaction data). Additionally or alternatively,the at least one random vector may include a second number of featuresless than the first number of features. In some non-limitingembodiments, the second neural network (e.g., the generator and/or thelike) may include an input for each feature of the second number offeatures (e.g., each feature of the at least one random vector).Additionally or alternatively, the second neural network (e.g., thegenerator and/or the like) may include an output for each feature of thefirst number of features (e.g., each feature of the generatedinteraction data and/or generate fraud label data).

In some non-limiting embodiments, the second neural network (e.g.,generator and/or the like) may include at least one of a secondmultilayer perceptron (MLP), a second fully connected neural network, asecond deep neural network, a second convolutional neural network, anycombination thereof, and/or the like. For example, the second neuralnetwork (e.g., generator and/or the like) may be a second fullyconnected neural network including an input layer with at least oneinput, an output layer with at least one output, and at least one hiddenlayer between the input layer and the output layer. In some non-limitingembodiments, the at least one hidden layer may include at least threehidden layers, up to five hidden layers, and/or the like.

As shown in FIG. 3, at step 310, process 300 may include generatingdiscrimination data. For example, a central system (e.g., transactionservice provider system 102 and/or the like) may generate discriminationdata for each interaction of the second plurality of interactions with athird neural network (e.g., discriminator and/or the like) based on theinteraction data for each interaction of the second plurality ofinteractions and the second fraud label data. Additionally oralternatively, the central system may generate discrimination data foreach generated interaction of the plurality of generated interactionswith the third neural network (e.g., discriminator and/or the like)based on the generated interaction data and the generated fraud labeldata. In some non-limiting embodiments, the discrimination data for eachinteraction or generated interaction may be associated with whether thethird neural network classifies the respective interaction or generatedinteraction as real or generated.

In some non-limiting embodiments, the discrimination data may include asingle bit or Boolean value. For example, the discrimination data (e.g.,bit or Boolean value) may be 1 or “True,” respectively, if theassociated interaction (or generated interaction) is classified as real,and 0 or “False” otherwise (or vice versa). In some non-limitingembodiments, the discrimination data may include two bits or Booleanvalues. For example, a first bit or Boolean value may be 1 or “True,”respectively, if the associated interaction (or generated interaction)is classified as fake (and 0 or “False” otherwise), and a second bit orBoolean value may be 1 or “True,” respectively, if the associatedinteraction (or generated interaction) is classified as generated (and 0or “False” otherwise). In some non-limiting embodiments, thediscrimination data may include a numerical value associated with aprobability that the interaction (or generated interaction) is fake (ora probability that the interaction or generated interaction is real).For example, such numerical value may be a number between 0 and 1,between 0 and 100, and/or the like.

In some non-limiting embodiments, the interaction data (and/or generatedinteraction data) may include the first number of features, as describedherein. In some non-limiting embodiments, the third neural network(e.g., the discriminator and/or the like) may include an input for eachfeature of the first number of features. Additionally or alternatively,the third neural network (e.g., discriminator and/or the like) mayinclude at least one output based on the discrimination data. Forexample, where the discrimination data includes a single bit or Booleanvalue, the third neural network (e.g., discriminator and/or the like)may include a single output (e.g., a bit or Boolean value as output).For example, where the discrimination data includes two bits or Booleanvalues, the third neural network (e.g., discriminator and/or the like)may include two outputs (e.g., two bits or Boolean values as output).For example, where the discrimination data includes a numerical value,the third neural network (e.g., discriminator and/or the like) mayinclude a single output (e.g., a numerical value as output).

In some non-limiting embodiments, the third neural network (e.g.,discriminator and/or the like) may include at least one of a thirdmultilayer perceptron (MLP), a third fully connected neural network, athird deep neural network, a third convolutional neural network, anycombination thereof, and/or the like. For example, the third neuralnetwork (e.g., discriminator and/or the like) may be a third fullyconnected neural network including an input layer with at least oneinput, an output layer with at least one output, and at least one hiddenlayer between the input layer and the output layer. In some non-limitingembodiments, the at least one hidden layer may include at least threehidden layers, up to five hidden layers, and/or the like.

As shown in FIG. 3, at step 312, process 300 may include determiningerror data. For example, a central system (e.g., transaction serviceprovider system 102 and/or the like) may determine error data for eachrespective interaction (e.g., of the second plurality of interactions)and/or each respective generated interaction. Additionally oralternatively, such determination may be associated with whether thediscrimination data for the respective interaction and/or generatedinteraction correctly classifies the respective interaction as real orfake, respectively.

In some non-limiting embodiments, the central system may determine firsterror data for each respective interaction of the second plurality ofinteractions based on the discrimination data. Additionally oralternatively, the first error data for each respective interaction maybe associated with whether the discrimination data for the respectiveinteraction correctly classifies the respective interaction as real.

In some non-limiting embodiments, the central system may determinesecond error data for each generated interaction of the generatedinteraction data based on the discrimination data. Additionally oralternatively, the second error data for each respective generatedinteraction may be associated with whether the discrimination data forthe respective generated interaction correctly classifies the respectivegenerated interaction as generated.

In some non-limiting embodiments, the form of the error data may dependon the form of the discrimination data. For example, where thediscrimination data includes a single bit or Boolean value, error datafor each interaction (or generated interaction) may also be a single bitor Boolean value. Additionally or alternatively, error data for eachinteraction (or generated interaction) may be a 1 or “True,”respectively, if the associated interaction (or generated interaction)is classified correctly (e.g., as real or generated, respectively), and0 or “False” otherwise. For example, where the discrimination dataincludes two bits or Boolean values, error data for each interaction (orgenerated interaction) may also be two bits or Boolean values.Additionally or alternatively, a first bit or Boolean value of errordata may be 1 or “True,” respectively, if the associated interaction (orgenerated interaction) is correctly classified (and 0 or “False”otherwise), and a second bit or Boolean value of error data may be 1 or“True,” respectively, if the associated interaction (or generatedinteraction) is incorrectly classified (and 0 or “False” otherwise). Forexample, where the discrimination data includes a numerical value, theerror data may also be a numerical value. For the purpose ofillustration, the numerical value of error data may be the same as thenumerical value of the discrimination data if the interaction (orgenerated interaction) is incorrectly classified (and 0 otherwise).

In some non-limiting embodiments, error data may include a numericalvalue indicating an error rate over multiple interactions and/orgenerated interactions. For example, error data may include a numericalvalue associated with a decimal between 0 and 1 based on the error rateof the discrimination data in correctly classifying the interactionsand/or generated interactions. In some non-limiting embodiments, firsterror data may include a numerical value associated with a decimalbetween 0 and 1 based on the error rate of the discrimination data incorrectly classifying the interactions of the second plurality ofinteractions. Additionally or alternatively, second error data mayinclude a numerical value associated with a decimal between 0 and 1based on the error rate of the discrimination data in correctlyclassifying the generated interactions of the generated interactiondata. In some non-limiting embodiments, error data may include a lossfunction and/or the like.

As shown in FIG. 3, at step 314, process 300 may include training atleast one neural network. For example, a central system (e.g.,transaction service provider system 102 and/or the like) may train atleast one of the first neural network (e.g., classifier and/or thelike), the second neural network (e.g., generator and/or the like),and/or the third neural network (e.g., the discriminator and/or thelike). In some non-limiting embodiments, such training may be based onat least some of the error data.

In some non-limiting embodiments, the central system may train the firstneural network (e.g., classifier and/or the like) based on first errordata associated with the interactions of the second plurality ofinteractions. Additionally or alternatively, the central system maytrain the first neural network based on the interaction data of thefirst plurality of transactions and the first fraud label data. In somenon-limiting embodiments, the central system may train the first neuralnetwork with the interaction data of the first plurality of transactionsand the first fraud label data initially (e.g., before generating thesecond fraud label data for the second plurality of transactions).Additionally or alternatively, after determining the (first) error data,the central system may train (e.g., retrain and/or the like) the firstneural network based on the first error data associated with theinteractions of the second plurality of interactions. Additionally oralternatively, after determining the (first) error data, the centralsystem may train (e.g., retrain and/or the like) the first neuralnetwork based on any combination of the (first) error data, the firstplurality of transactions, and the first fraud label data. In somenon-limiting embodiments, the central system may train the first neuralnetwork based on the generated interaction data and the generated fraudlabel data. For example, after generating the generated interactiondata, the central system may train (e.g., retrain and/or the like) thefirst neural network based on the generated interaction data and thegenerated fraud label data. Additionally or alternatively, aftergenerating the generated interaction data, the central system may train(e.g., retrain and/or the like) the first neural network based on anycombination of the (first) error data, the first plurality oftransactions, the first fraud label data, the generated interactiondata, and the generated fraud label data. In some non-limitingembodiments, the first neural network may be trained to reduce errorsassociated with the (first) error data.

In some non-limiting embodiments, the central system may train thesecond neural network (e.g., generator and/or the like) based on seconderror data associated with the generated interactions of the generatedinteraction data. In some non-limiting embodiments, the second neuralnetwork may be trained to increase errors associated with the (second)error data.

In some non-limiting embodiments, the central system may train the thirdneural network (e.g., discriminator and/or the like) based on at leastone of the first error data and/or the second error data. Additionallyor alternatively, the central system may train the third neural networkbased on the interaction data of the first plurality of transactions andthe first fraud label data. In some non-limiting embodiments, thecentral system may train the third neural network with the interactiondata of the first plurality of transactions and the first fraud labeldata initially (e.g., before generating the discrimination data).Additionally or alternatively, after determining the error data (e.g.,the first error data and/or the second error data), the central systemmay train (e.g., retrain and/or the like) the third neural network basedon the error data (e.g., the first error data and/or the second errordata). Additionally or alternatively, after determining the error data(e.g., the first error data and/or the second error data), the centralsystem may train (e.g., retrain and/or the like) the third neuralnetwork based on any combination of the error data (e.g., the firsterror data and/or the second error data), the interaction data of thefirst plurality of transactions, and the first fraud label data. In somenon-limiting embodiments, the third neural network may be trained toreduce errors associated with the (first and second) error data.

In some non-limiting embodiments, training of the neural network(s)(e.g., by the central system) may include at least one of backpropagation training, gradient descent training, stochastic gradientdescent training, batch (or mini-batch) gradient descent training,adaptive gradient training, conjugate gradient training, momentumtraining, adaptive momentum training, Newton's method/Hessian matrixtraining, quasi-Newton method training, Levenberg-Marquardt methodtraining, and/or the like.

In some non-limiting embodiments, the central system (e.g., transactionservice provider system 102 and/or the like) may continue to iterativelyrepeat at least one of steps 302, 304, 306, 308, 310, 312, and/or 314.For example, additional interaction data may be received and/orretrieved, as described herein (302). Additionally or alternatively,additional label data may be received for at least some interactions, asdescribed herein (304). Additionally or alternatively, the first neuralnetwork may be used to generate label data for unlabeled interactions(e.g., newly received interactions, the same interactions as before butwith the benefit of having trained/retrained the first neural network,and/or the like), as described herein (306). Additionally oralternatively, the second neural network may be used to generate newgenerated interaction data (e.g., with the benefit of havingtrained/retrained the second neural network), as described herein (308).Additionally or alternatively, the third neural network may be used togenerate new discrimination data (e.g., based on the newly receivedinteractions, based on the new labels generates for the second pluralityof interactions and/or newly received interactions, based on the newgenerated interaction data, and/or the like), as described herein (310).Additionally or alternatively, new error data may be determined based onthe new discrimination data, as described herein (312). Additionally oralternatively, at least one of the neural networks may be trained (e.g.,based on the new error data), as described herein (314). In somenon-limiting embodiments, the iterative repetition of at least some ofsteps 302, 304, 306, 308, 310, 312, and/or 314 may be continued (e.g.,by the central system) until a termination condition is satisfied. Forexample, the termination condition may include at least one of the firsterror data or the second error data being below a threshold (e.g.,accuracy improved so error data decreased below a threshold).Additionally or alternatively, the termination condition may include amarginal difference in at least one of the first error data or thesecond error data between successive iterations being below a threshold(e.g., error rate did not significantly change between successiveiterations or between a selected number of successive iterations).Additionally or alternatively, the termination condition may include aselected total number of iterations.

As shown in FIG. 3, at step 316, process 300 may include generatinglabels for further interaction data. For example, a central system(e.g., transaction service provider system 102 and/or the like) mayreceive further interaction data associated with at least one furtherinteraction (e.g., new incoming payment transaction, new communication,and/or the like). Additionally or alternatively, the central system maygenerate further label data (e.g., further fraud label data and/or thelike) for the at least one further interaction with the first neuralnetwork (e.g., classifier and/or the like) based on the furtherinteraction data. For example, having been trained, the first neuralnetwork (e.g., classifier and/or the like) may be able to accuratelyclassify whether the further interaction is fraudulent. In somenon-limiting embodiments, the further fraud label data for the at leastone further interaction may be associated with whether the first neuralnetwork (e.g., classifier and/or the like) classifies the at least onefurther interaction as fraudulent.

In some non-limiting embodiments, the further fraud label data mayinclude a single bit or Boolean value, as described herein. Additionallyor alternatively, the further fraud label data may include two bits orBoolean values, as described herein. Additionally or alternatively, thefurther fraud label data may include a numerical value associated with aprobability that the further interaction is fraudulent, as describedherein. For example, the output of the first neural network (e.g.,classifier and/or the like) may include the numerical value.

In some non-limiting embodiments, the further fraud label data may beused to determine a fraud score (e.g., by a scoring platform of thecentral system). For example, such fraud score may be determined basedon the further fraud label data. Additionally or alternatively, suchfraud score may be determined based at least in part on other dataseparate from or including the further fraud label data, such as datafrom at least one other model (e.g., neural network, classifier model,and/or the like), data from at least one predefined rule, and/or thelike.

In some non-limiting embodiments, at least one action (e.g., remedialaction) may be taken (e.g., by the central system) based on the furtherfraud label data. For example, where the interaction is a transaction(e.g., payment transaction), such transaction may be declined/rejectedby the central system (e.g., transaction service provider system 102).Additionally or alternatively, such transaction may be flagged (e.g.,marked, posted/added to a list, sorted, and/or the like) for review bythe central system (e.g., transaction service provider system 102).Additionally or alternatively, at least one message (e.g., alert messageand/or the like) may be generated and/or communicated (e.g., to a userdevice of transaction service provider system 102, issuer system 104,and/or the like) by the central system (e.g., transaction serviceprovider system 102) based on the transaction, and the at least onemessage may indicate and/or recommend that the transaction bedeclined/rejected, reviewed, and/or the like. For example, where theinteraction is a communication (e.g., public and/or private message,email, text message, telephone call, voice over internet protocol (VoIP)call, social media post, website, and/or the like), such communicationmay be declined, rejected, and/or deleted by the central system (e.g.,spam filter and/or the like). Additionally or alternatively, suchcommunication and/or an account associated with such communication maybe flagged (e.g., marked, posted/added to a list, sorted, and/or thelike) for review by the central system. Additionally or alternatively,at least one message (e.g., alert message and/or the like) may begenerated and/or communicated (e.g., to a user device and/or the like)by the central system based on the communication, and the at least onemessage may indicate and/or recommend that the communication bedeclined, rejected, deleted, reviewed, and/or the like.

Referring now to FIG. 4, FIG. 4 is a diagram of an exemplaryimplementation 400 of a non-limiting embodiment relating to process 300shown in FIG. 3. In some non-limiting embodiments or aspects,implementation 400 may be implemented (e.g., completely, partially,and/or the like) by transaction service provider system 102 (e.g., oneor more devices of transaction service provider system 102). In somenon-limiting embodiments or aspects, implementation 400 may beimplemented (e.g., completely, partially, and/or the like) by anothersystem, another device, another group of systems, or another group ofdevices, separate from or including transaction service provider system102, such as merchant system 108 (e.g., one or more devices of merchantsystem 108), issuer system 104 (e.g., one or more devices of issuersystem 104), customer device 106, and/or acquirer system 110 (e.g., oneor more devices of acquirer system 110). In some non-limitingembodiments, a central system may be implemented (e.g., completely,partially, and/or the like) by transaction service provider system 102.In some non-limiting embodiments, a central system may be implemented(e.g., completely, partially, and/or the like) by another system,another device, another group of systems, or another group of devices,separate from or including transaction service provider system 102, suchas issuer system 104, customer device 106, merchant system 108, acquirersystem 110, and/or the like.

As shown in FIG. 4, implementation 400 may include classifier 402 a,generator 402 b, and/or discriminator 402 c. In some non-limitingembodiments, classifier 402 a may include at least one (e.g., a first)neural network. Additionally or alternatively, generator 402 b mayinclude at least one (e.g., a second) neural network. Additionally oralternatively, discriminator 402 c may include at least one (e.g., athird) neural network. In some non-limiting embodiments, the classifier402 a may be the same as or similar to the first neural network of thecentral system (e.g., transaction service provider system 102 and/or thelike), as described herein. In some non-limiting embodiments, generator402 b may be the same as or similar to the second neural network of thecentral system (e.g., transaction service provider system 102 and/or thelike), as described herein. In some non-limiting embodiments,discriminator 402 c may be the same as or similar to the third neuralnetwork of the central system (e.g., transaction service provider system102 and/or the like), as described herein.

In some non-limiting embodiments, the central system (e.g., transactionservice provider system 102 and/or the like) may receive interactiondata (e.g., payment transaction data, non-payment transaction data,communication data, and/or the like, as described herein) associatedwith a plurality of interactions, as described herein. In somenon-limiting embodiments, the interaction data may include firstinteractions 402 d and second interactions 402 e (which may be differentthan the first interactions 402 d). For example, interaction data forfirst of interactions 402 e may include label data (e.g., fraud labeldata and/or the like), as described herein. Additionally oralternatively, second interactions 402 e may initially lack label data(e.g., fraud label data and/or the like), as described herein. In somenon-limiting embodiments, classifier 402 a and/or discriminator 402 cmay be initially trained based on the first interactions 402 d(including labels thereof), as described herein.

In some non-limiting embodiments, generator 402 b may generate generatedinteractions 402 f, as described herein. For example, at least onerandom vector 402 i may be generated (e.g., by the central system), andgenerator 402 b may generate generated interactions 402 f based on atleast one random vector 402 i, as described herein. In some non-limitingembodiments, generated interaction data for generated interactions 402 fmay include generated label data (e.g., generated fraud label data), asdescribed herein. In some non-limiting embodiments, classifier 402 a maybe trained based on generated interactions 402 f (including generatedlabels thereof), as described herein. In some non-limiting embodiments,generated interactions 402 f (including generated labels thereof) may beprovided to discriminator 402 c, as described herein.

In some non-limiting embodiments, classifier 402 a may generate labels(e.g., second fraud labels) for second interactions 402 e, as describedherein. Additionally or alternatively, second interactions 402 e(including the second fraud labels generated therefor) may be providedto discriminator 402 c, as described herein.

In some non-limiting embodiments, discriminator 402 c may generatediscrimination data, as described herein. For example, discriminator 402c may generate discrimination data based on whether each interaction ofsecond interactions 402 e and each generated interaction of generatedinteraction 402 f is real or generated (e.g., fake), as describedherein. Additionally, error data may be determined (e.g., by the centralsystem) based on the discrimination data, as described herein. Forexample, first error data 402 g may be determined based ondiscrimination data associated with second interactions 402 e, asdescribed herein. Additionally or alternatively, second error data 402 hmay be determined based on discrimination data associated with generatedinteractions 402 f, as described herein.

In some non-limiting embodiments, classifier 402 a may be trained (e.g.,further trained, retrained, and/or the like) based on first error data402 g, as described herein. Additionally or alternatively, generator 402b may be trained (e.g., further trained, retrained, and/or the like)based on second error data 402 h, as described herein. Additionally oralternatively, discriminator 402 c may be trained (e.g., furthertrained, retrained, and/or the like) based on first error data 402 g,second error data 402 h, and/or the like, as described herein.

Referring now to FIG. 5, FIG. 5 is a diagram of an exemplaryimplementation 500 of a non-limiting embodiment relating to process 300shown in FIG. 3. In some non-limiting embodiments or aspects,implementation 500 may be implemented (e.g., completely, partially,and/or the like) by transaction service provider system 102 (e.g., oneor more devices of transaction service provider system 102). In somenon-limiting embodiments or aspects, implementation 500 may beimplemented (e.g., completely, partially, and/or the like) by anothersystem, another device, another group of systems, or another group ofdevices, separate from or including transaction service provider system102, such as merchant system 108 (e.g., one or more devices of merchantsystem 108), issuer system 104 (e.g., one or more devices of issuersystem 104), customer device 106, and/or acquirer system 110 (e.g., oneor more devices of acquirer system 110).

As shown in FIG. 5, implementation 500 may include interaction datadatabase 502 j, user device 502 k, central system 502 abc, classifier502 a, generator 502 b, discriminator 502 c, other models 502 m, scoringplatform 502 n, network 512, and/or the like. In some non-limitingembodiments, central system 502 abc may be implemented (e.g.,completely, partially, and/or the like) by transaction service providersystem 102. In some non-limiting embodiments, central system 502 abc maybe implemented (e.g., completely, partially, and/or the like) by anothersystem, another device, another group of systems, or another group ofdevices, separate from or including transaction service provider system102, such as issuer system 104, customer device 106, merchant system108, acquirer system 110, and/or the like. In some non-limitingembodiments, classifier 502 a may include at least one (e.g., a first)neural network. Additionally or alternatively, generator 502 b mayinclude at least one (e.g., a second) neural network. Additionally oralternatively, discriminator 502 c may include at least one (e.g., athird) neural network. In some non-limiting embodiments, the classifier502 a may be the same as or similar to classifier 402 a and/or the firstneural network of the central system (e.g., transaction service providersystem 102 and/or the like), as described herein. In some non-limitingembodiments, generator 502 b may be the same as or similar to generator402 b and/or the second neural network of the central system (e.g.,transaction service provider system 102 and/or the like), as describedherein. In some non-limiting embodiments, discriminator 502 c may be thesame as or similar to discriminator 402 d and/or the third neuralnetwork of the central system (e.g., transaction service provider system102 and/or the like), as described herein. In some non-limitingembodiments, interaction data database 502 j, user device 502 k, othermodels 502 m, and/or scoring platform 502 n each may be implemented(e.g., completely, partially, and/or the like) by transaction serviceprovider system 102. In some non-limiting embodiments, at least one ofinteraction data database 502 j, user device 502 k, other models 502 m,and/or scoring platform 502 n may be implemented (e.g., completely,partially, and/or the like) by another system, another device, anothergroup of systems, or another group of devices, separate from orincluding transaction service provider system 102, such as issuer system104, customer device 106, merchant system 108, acquirer system 110,and/or the like. In some non-limiting embodiments, network 512 may bethe same as or similar to network 112.

In some non-limiting embodiments, interaction database 502 j may receiveinteraction data (e.g., payment transaction data, non-paymenttransaction data, communication data, and/or the like, as describedherein) associated with a plurality of interactions from network 512, asdescribed herein. In some non-limiting embodiments, the interaction datamay include first interactions 502 d, second interactions 502 e (whichmay be different than first interactions 502 d), and/or furtherinteraction data 502 l (which may be different than first interactions502 d and/or second interaction 502 e), as described herein. Forexample, interaction data for first interactions 502 d may include labeldata (e.g., fraud label data and/or the like), as described herein.Additionally or alternatively, interaction data for first interactions502 d may initially lack label data (e.g., fraud label data and/or thelike). Additionally or alternatively, second interactions 502 e and/orfurther interaction data 502 l may initially lack label data (e.g.,fraud label data and/or the like), as described herein.

In some non-limiting embodiments, first interactions 502 d may beprovided to (e.g., communicated to, made accessible by, and/or the like)at least one user device 502 k. At least one user (e.g., an agent of atransaction service provider and/or the like) may manually review firstinteractions 502 d using at least one user device 502 k. For example,such user(s) may provide label data (e.g., fraud label data and/or thelike) associated with the interaction data of first interactions 502 d,as described herein. In some non-limiting embodiments, firstinteractions 502 d (including labels thereof) may be provided to (e.g.,communicated to, received by, and/or the like) central system 502 abc.In some non-limiting embodiments, classifier 502 a and/or discriminator502 c may be initially trained (by central system 502 abc) based onfirst interactions 502 d (including labels thereof), as describedherein.

In some non-limiting embodiments, second interactions 502 e may beprovided to (e.g., communicated to, received by, and/or the like)central system 502 abc. Additionally or alternatively, furtherinteraction data 502 _(l) may be provided to (e.g., communicated to,received by, and/or the like) central system 502 abc.

In some non-limiting embodiments, generator 502 b may generate generatedinteractions, as described herein. For example, at least one randomvector may be generated (e.g., by central system 502 abc), and generator502 b may generate generated interactions based on the at least onerandom vector, as described herein. In some non-limiting embodiments,generated interaction data for generated interactions may includegenerated label data (e.g., generated fraud label data), as describedherein. In some non-limiting embodiments, classifier 502 a may betrained based on generated interactions (including generated labelsthereof), as described herein. In some non-limiting embodiments,generated interactions (including generated labels thereof) may beprovided to discriminator 502 c, as described herein.

In some non-limiting embodiments, classifier 502 a may generate labels(e.g., second fraud labels, further fraud labels, and/or the like) forsecond interactions 502 e and/or further interaction data 502 _(l), asdescribed herein. Additionally or alternatively, second interactions 502e (including the second fraud labels generated therefor) and/or furtherinteraction data 502 _(l) (including the further fraud labels generatedtherefor) may be provided to discriminator 502 c, as described herein.

In some non-limiting embodiments, discriminator 502 c may generatediscrimination data, as described herein. For example, discriminator 502c may generate discrimination data based on whether each interaction ofsecond interactions 502 e, each interaction of further interaction data502 _(l), and/or each generated interaction of generated interaction 502f is real or generated (e.g., fake), as described herein. Additionallyor alternatively, error data may be determined (e.g., by central system502 abc) based on the discrimination data, as described herein. Forexample, first error data may be determined based on discrimination dataassociated with second interactions, as described herein. Additionallyor alternatively, second error data may be determined based ondiscrimination data associated with generated interactions, as describedherein.

In some non-limiting embodiments, classifier 502 a may be trained (e.g.,further trained, retrained, and/or the like) based on the first errordata, as described herein. Additionally or alternatively, generator 502b may be trained (e.g., further trained, retrained, and/or the like)based on the second error data, as described herein. Additionally oralternatively, discriminator 502 c may be trained (e.g., furthertrained, retrained, and/or the like) based on the first error data, thesecond error data, and/or the like, as described herein.

In some non-limiting embodiments, at least one of second interactions502 e (including the second fraud labels generated therefor) and/orfurther interaction data 502 _(l) (including the further fraud labelsgenerated therefor) may be provided to other models 502 m. In somenon-limiting embodiments, other models 502 m may include at least oneother model (e.g., neural network, classifier model, and/or the like).In some non-limiting embodiments, other models 502 m may use at leastone of second interactions 502 e (including the second fraud labelsgenerated therefor) and/or further interaction data 502 _(l) (includingthe further fraud labels generated therefor) for training. Additionallyor alternatively, other models 502 m may determine scores (e.g., fraudscores associated with a probability that the respective interaction isfraudulent and/or the like) based on at least one of second interactions502 e and/or further interaction data 502 _(l.)

In some non-limiting embodiments, at least one of second interactions502 e (including the second fraud labels generated therefor) and/orfurther interaction data 502 _(l) (including the further fraud labelsgenerated therefor) may be provided (e.g., communicated to, received by,and/or the like) to scoring platform 502 n. Additionally oralternatively, scoring platform 502 n may determine an overall fraudscore (e.g., an overall probability that the respective interaction isfraudulent and/or the like) for each respective interaction of at leastone of second interactions 502 e and/or further interaction data 502_(l). In some non-limiting embodiments, scoring platform 502 n maydetermine the overall fraud score for each respective interaction basedon the fraud label data of the respective interaction. Additionally oralternatively, scoring platform 502 n may determine the overall fraudscore for each respective interaction based at least in part on scoresfrom other models 502 m.

In some non-limiting embodiments, at least one interaction of at leastone of second interactions 502 e and/or further interaction data 502_(l) may be flagged by central system 502 abc based on the respectivelabel (e.g., fraud label) thereof, as described herein. Additionally oralternatively, such at least one interaction may be provided to (e.g.,communicated to, received by, made accessible by, and/or the like) userdevice 502 k by central system 502 abc. In some non-limitingembodiments, at least one interaction of at least one of secondinteractions 502 e and/or further interaction data 502 _(l) may beflagged by scoring platform 502 n based on the respective overall scorethereof. Additionally or alternatively, such at least one interactionmay be provided to (e.g., communicated to, received by, made accessibleby, and/or the like) user device 502 k by scoring platform 502 n.

Referring now to FIGS. 6A-6C, FIGS. 6A-6C are diagrams of exemplaryimplementations of neural networks that may be used in non-limitingembodiments relating to process 300 shown in FIG. 3. In somenon-limiting embodiments or aspects, each of neural networks 600 a, 600b, 600 c may be implemented (e.g., completely, partially, and/or thelike) by transaction service provider system 102 (e.g., one or moredevices of transaction service provider system 102). In somenon-limiting embodiments or aspects, at least one of neural networks 600a, 600 b, 600 c may be implemented (e.g., completely, partially, and/orthe like) by another system, another device, another group of systems,or another group of devices, separate from or including transactionservice provider system 102, such as merchant system 108 (e.g., one ormore devices of merchant system 108), issuer system 104 (e.g., one ormore devices of issuer system 104), customer device 106, and/or acquirersystem 110 (e.g., one or more devices of acquirer system 110). In somenon-limiting embodiments, neural network 600 a may be the same as orsimilar to classifier 402 a, classifier 502 a, and/or the first neuralnetwork of the central system (e.g., transaction service provider system102 and/or the like), as described herein. In some non-limitingembodiments, neural network 600 b may be the same as or similar togenerator 402 b, generator 502 b, and/or the second neural network ofthe central system (e.g., transaction service provider system 102 and/orthe like), as described herein. In some non-limiting embodiments, neuralnetwork 600 c may be the same as or similar to discriminator 402 d,discriminator 502 c, and/or the third neural network of the centralsystem (e.g., transaction service provider system 102 and/or the like),as described herein.

As shown in FIG. 6A, neural network 600 a may include a first fullyconnected neural network including input layer 602 a with at least oneinput (e.g., 100 inputs and/or the like), output layer 608 a with atleast one output (e.g., 1 output, 2 outputs, and/or the like), and atleast one hidden layer (e.g., first hidden layer 604 a, last hiddenlayer 606 a, and/or the like) between input layer 602 a and the outputlayer 608 a. In some non-limiting embodiments, the at least one hiddenlayer (e.g., first hidden layer 604 a, last hidden layer 606 a, and/orthe like) may include at least three hidden layers, up to five hiddenlayers, and/or the like.

In some non-limiting embodiments, the interaction data may include afirst number of features (e.g., 100 features and/or the like).Additionally or alternatively, neural network 600 a may include an inputfor each feature of the first number of features. Additionally oralternatively, neural network 600 a may include at least one outputbased on the (second) fraud label data. For example, where the (second)fraud label data includes a single bit or Boolean value, neural network600 a may include a single output (e.g., a bit or Boolean value asoutput). For example, where the (second) fraud label data includes twobits or Boolean values, neural network 600 a may include two outputs(e.g., two bits or Boolean values as output). For example, where the(second) fraud label data includes a numerical value, neural network 600a may include a single output (e.g., a numerical value as output).

As shown in FIG. 6B, neural network 600 b may include neural network 600b may include a second fully connected neural network including inputlayer 602 b with at least one input (e.g., 10 inputs and/or the like),an output layer with at least one output (e.g., 100 outputs and/or thelike), and at least one hidden layer (e.g., first hidden layer 604 b,last hidden layer 606 b, and/or the like) between input layer 602 b andoutput layer 608 b. In some non-limiting embodiments, the at least onehidden layer (e.g., first hidden layer 604 b, last hidden layer 606 b,and/or the like) may include at least three hidden layers, up to fivehidden layers, and/or the like.

In some non-limiting embodiments, the generated interaction data mayinclude the first number of features (e.g., 100 features, the samenumber of features as the (real) interaction data, and/or the like).Additionally or alternatively, the random vector may include a secondnumber of features (e.g., 10 features, less than the first number offeatures, and/or the like). In some non-limiting embodiments, neuralnetwork 600 b may include an input for each feature of the second numberof features (e.g., each feature of the random vector, such as 10features and/or the like). Additionally or alternatively, neural network600 b may include an output for each feature of the first number offeatures (e.g., 100 features, each feature of the generated interactiondata and/or generated fraud label data, and/or the like).

As shown in FIG. 6C, neural network 600 c may include a third fullyconnected neural network including input layer 602 a with at least oneinput (e.g., 100 inputs and/or the like), output layer 608 c with atleast one output (e.g., 1 output, 2 outputs, and/or the like), and atleast one hidden layer (e.g., first hidden layer 604 c, last hiddenlayer 606 c, and/or the like) between input layer 602 c and the outputlayer 608 c. In some non-limiting embodiments, the at least one hiddenlayer (e.g., first hidden layer 604 c, last hidden layer 606 c, and/orthe like) may include at least three hidden layers, up to five hiddenlayers, and/or the like.

In some non-limiting embodiments, the interaction data (and/or generatedinteraction data) may include the first number of features (e.g., 100features and/or the like), as described herein. In some non-limitingembodiments, neural network 600 c may include an input for each featureof the first number of features. Additionally or alternatively, neuralnetwork 600 c may include at least one output based on thediscrimination data. For example, where the discrimination data includesa single bit or Boolean value, neural network 600 c may include a singleoutput (e.g., a bit or Boolean value as output). For example, where thediscrimination data includes two bits or Boolean values, neural network600 c may include two outputs (e.g., two bits or Boolean values asoutput). For example, where the discrimination data includes a numericalvalue, neural network 600 c may include a single output (e.g., anumerical value as output).

Although the disclosed subject matter has been described in detail forthe purpose of illustration based on what is currently considered to bethe most practical and preferred embodiments, it is to be understoodthat such detail is solely for that purpose and that the disclosedsubject matter is not limited to the disclosed embodiments, but, on thecontrary, is intended to cover modifications and equivalent arrangementsthat are within the spirit and scope of the appended claims. Forexample, it is to be understood that the presently disclosed subjectmatter contemplates that, to the extent possible, one or more featuresof any embodiment can be combined with one or more features of any otherembodiment.

What is claimed is:
 1. A method for detecting fraudulent interactions, comprising: receiving, with at least one processor, interaction data associated with a plurality of interactions, the plurality of interactions comprising a first plurality of interactions and a second plurality of interactions different than the first plurality of interactions; receiving, with at least one processor, first fraud label data for each respective interaction of the first plurality of interactions, the first fraud label data associated with whether the respective interaction of the first plurality of interactions is fraudulent; generating, with at least one processor, second fraud label data for each interaction of the second plurality of interactions with a first neural network based on the interaction data of the second plurality of interactions, the second fraud label data for each respective interaction of the second plurality of interactions associated with whether the first neural network classifies the respective interaction as fraudulent; generating, with at least one processor, generated interaction data associated with a plurality of generated interactions and generated fraud label data for each generated interaction of the plurality of generated interactions with a second neural network; generating, with at least one processor, discrimination data for each interaction of the second plurality of interactions and each generated interaction of the plurality of generated interactions with a third neural network based on the interaction data for each interaction of the second plurality of interactions, the second fraud label data, the generated interaction data, and the generated fraud label data, the discrimination data for each interaction or generated interaction associated with whether the third neural network classifies the respective interaction or generated interaction as real or generated; determining, with at least one processor, first error data for each respective interaction of the second plurality of interactions based on the discrimination data, the first error data for each respective interaction associated with whether the discrimination data for the respective interaction correctly classifies the respective interaction as real; and training, with at least one processor, the first neural network based on the first error data associated with the interactions of the second plurality of interactions.
 2. The method of claim 1, further comprising training, with at least one processor, the first neural network based on the interaction data of the first plurality of transactions and the first fraud label data.
 3. The method of claim 2, further comprising training, with at least one processor, the first neural network based on the generated interaction data and the generated fraud label data.
 4. The method of claim 1, further comprising: determining, with at least one processor, second error data for each generated interaction of the generated interaction data based on the discrimination data, the second error data for each respective generated interaction associated with whether the discrimination data for the respective generated interaction correctly classifies the respective generated interaction as generated; and training, with at least one processor, the second neural network based on the second error data associated with the generated interactions of the generated interaction data.
 5. The method of claim 1, further comprising: training, with at least one processor, the third neural network based on at least one of the first error data, the second error data, the interaction data of the first plurality of transactions, the first fraud label data, or any combination thereof.
 6. The method of claim 1, further comprising generating, with at least one processor, at least one random vector, wherein generating the generated interaction data and the generated fraud label data comprises generating, with at least one processor, the generated interaction data associated with the plurality of generated interactions and the generated fraud label data for each generated interaction of the plurality of generated interactions with the second neural network based on the at least one random vector.
 7. The method of claim 1, wherein the first neural network comprises a classifier, the second neural network comprises a generator, and the third neural network comprises a discriminator.
 8. The method of claim 7, wherein the interaction data comprises a first number of features and the generated interaction data comprises the first number of features, wherein at least one random vector comprises a second number of features less than the first number of features, wherein the generator comprises an input for each feature of the second number of features and an output for each feature of the first number of features, wherein the classifier comprises an input for each feature of the first number of features and a single output, and wherein the discriminator comprises an input for each feature of the first number of features and a single output.
 9. The method of claim 1, wherein the first neural network comprises at least one of a first multilayer perceptron (MLP), a first fully connected neural network, a first deep neural network, a first convolutional neural network, or any combination thereof, wherein the second neural network comprises at least one of a second MLP, a second fully connected neural network, a second deep neural network, a second convolutional neural network, or any combination thereof, and wherein the third neural network comprises at least one of a third MLP, a third fully connected neural network, a third deep neural network, a third convolutional neural network, or any combination thereof.
 10. The method of claim 1, further comprising: receiving, with at least one processor, further interaction data associated with at least one further interaction; and generating, with at least one processor, further fraud label data for the at least one further interaction with the first neural network based on the further interaction data, the further fraud label data for the at least one further interaction associated with whether the first neural network classifies the at least one further interaction as fraudulent.
 11. A system for detecting fraudulent interactions, comprising: at least one processor; and at least one non-transitory computer-readable medium comprising instructions to direct the at least one processor to: receive interaction data associated with a plurality of interactions, the plurality of interactions comprising a first plurality of interactions and a second plurality of interactions different than the first plurality of interactions; receive first fraud label data for each respective interaction of the first plurality of interactions, the first fraud label data associated with whether the respective interaction of the first plurality of interactions is fraudulent; generate second fraud label data for each interaction of the second plurality of interactions with a first neural network based on the interaction data of the second plurality of interactions, the second fraud label data for each respective interaction of the second plurality of interactions associated with whether the first neural network classifies the respective interaction as fraudulent; generate generated interaction data associated with a plurality of generated interactions and generated fraud label data for each generated interaction of the plurality of generated interactions with a second neural network; generate discrimination data for each interaction of the second plurality of interactions and each generated interaction of the plurality of generated interactions with a third neural network based on the interaction data for each interaction of the second plurality of interactions, the second fraud label data, the generated interaction data, and the generated fraud label data, the discrimination data for each interaction or generated interaction associated with whether the third neural network classifies the respective interaction or generated interaction as real or generated; determine first error data for each respective interaction of the second plurality of interactions based on the discrimination data, the first error data for each respective interaction associated with whether the discrimination data for the respective interaction correctly classifies the respective interaction as real; and train the first neural network based on the first error data associated with the interactions of the second plurality of interactions.
 12. The system of claim 11, wherein the instructions further direct the at least one processor to train the first neural network based on the interaction data of the first plurality of transactions and the first fraud label data.
 13. The system of claim 12, wherein the instructions further direct the at least one processor to train the first neural network based on the generated interaction data and the generated fraud label data.
 14. The system of claim 11, wherein the instructions further direct the at least one processor to: determine second error data for each generated interaction of the generated interaction data based on the discrimination data, the second error data for each respective generated interaction associated with whether the discrimination data for the respective generated interaction correctly classifies the respective generated interaction as generated; and train the second neural network based on the second error data associated with the generated interactions of the generated interaction data.
 15. The system of claim 11, wherein the instructions further direct the at least one processor to: train the third neural network based on at least one of the first error data, the second error data, the interaction data of the first plurality of transactions, the first fraud label data, or any combination thereof.
 16. The system of claim 11, wherein the instructions further direct the at least one processor to generate at least one random vector, wherein generating the generated interaction data and the generated fraud label data comprises generating the generated interaction data associated with the plurality of generated interactions and the generated fraud label data for each generated interaction of the plurality of generated interactions with the second neural network based on the at least one random vector.
 17. The system of claim 11, wherein the first neural network comprises a classifier, the second neural network comprises a generator, and the third neural network comprises a discriminator, wherein the interaction data comprises a first number of features and the generated interaction data comprises the first number of features, wherein at least one random vector comprises a second number of features less than the first number of features, wherein the generator comprises an input for each feature of the second number of features and an output for each feature of the first number of features, wherein the classifier comprises an input for each feature of the first number of features and a single output, and wherein the discriminator comprises an input for each feature of the first number of features and a single output.
 18. The system of claim 11, wherein the first neural network comprises at least one of a first multilayer perceptron (MLP), a first fully connected neural network, a first deep neural network, a first convolutional neural network, or any combination thereof, wherein the second neural network comprises at least one of a second MLP, a second fully connected neural network, a second deep neural network, a second convolutional neural network, or any combination thereof, and wherein the third neural network comprises at least one of a third MLP, a third fully connected neural network, a third deep neural network, a third convolutional neural network, or any combination thereof.
 19. The system of claim 11, wherein the instructions further direct the at least one processor to: receive further interaction data associated with at least one further interaction; and generate further fraud label data for the at least one further interaction with the first neural network based on the further interaction data, the further fraud label data for the at least one further interaction associated with whether the first neural network classifies the at least one further interaction as fraudulent.
 20. A computer program product for detecting fraudulent interactions, the computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to: receive interaction data associated with a plurality of interactions, the plurality of interactions comprising a first plurality of interactions and a second plurality of interactions different than the first plurality of interactions; receive first fraud label data for each respective interaction of the first plurality of interactions, the first fraud label data associated with whether the respective interaction of the first plurality of interactions is fraudulent; generate second fraud label data for each interaction of the second plurality of interactions with a first neural network based on the interaction data of the second plurality of interactions, the second fraud label data for each respective interaction of the second plurality of interactions associated with whether the first neural network classifies the respective interaction as fraudulent; generate generated interaction data associated with a plurality of generated interactions and generated fraud label data for each generated interaction of the plurality of generated interactions with a second neural network; generate discrimination data for each interaction of the second plurality of interactions and each generated interaction of the plurality of generated interactions with a third neural network based on the interaction data for each interaction of the second plurality of interactions, the second fraud label data, the generated interaction data, and the generated fraud label data, the discrimination data for each interaction or generated interaction associated with whether the third neural network classifies the respective interaction or generated interaction as real or generated; determine first error data for each respective interaction of the second plurality of interactions based on the discrimination data, the first error data for each respective interaction associated with whether the discrimination data for the respective interaction correctly classifies the respective interaction as real; and train the first neural network based on the first error data associated with the interactions of the second plurality of interactions. 